SharePoint Permission Management on a List

Question

I need some help related to: Permissions

This is scenario:

1. A new site on the platform. Purpose is to conduct approval on Items.
2. A Request List to which 'Creation form' will create Item.
3. Anyone can request Item for approval. A generic site collection wide SP group which contain all the members is given 'Contribute' permission on this List.
4. Once Item is created; a workflow is triggered ( through Nintex 2013 which is the workflow engine ).
5. The workflow consists of getting approvals from various approvers. Conditionally; the workflow may require special approval. This involves filling up a sister form and creating an item in the Special Approval List.
6. Now, I want to restrict permissions on the Request Item such that only the current approver will be able to edit Item details. Initially; we have given 'Contribute' to all members who will be using the site.

Methods considered:

1. Change permission once the workflow starts using 'Set Item Permissions' action such that the person who Requests cannot edit.

   Problem --> Information on the internet points out that setting Item level permissions can get messy very quickly and not a recommended solution for performance considerations.

2. Run the workflow steps as 'Workflow Owner'. This solution involves giving the group with all the members 'Add only' permission so that they can create a request but do no edit it. Workflow actions which involves modifying the List item will be executed as Author who publishes the workflow.

   Problem --> This could potentially work. We have noticed that some Workflow tasks are created twice when it comes inside an 'Action set' that is set to execute as Author. Another thing is that we want to give the ability to Save drafts; so 'Add only' permission does not meet this.

Answer 1

I would go with first method you considered. Break the item permission and grant only to Owner group and the approver. Once the approval is done, kick off another workflow to switch back permission inheritance. This way the only items that will have unique item permissions are the once that are pending approval.