You can control the access to portal objects based on:

• Location - use Local Roles tab on the folders to control which users are considered reviewers, owners, managers, etc.
• State (Publishing status) - use permissions on a workflow to define which roles have access in each state.

The following instructions will show how to copy and modify a workflow to restrict access. By default, objects that are in a visible or pending status are viewable by any logged in user. I did not want to make that content available until it was officially published, however, certain users need access to certain areas (folders) in order to add, revise and publish the content they are responsible for. I used Local Roles to give specific users status in a folder as reviewers, owners, or managers.

1. In the ZMI, go into your Plone folder, then into "portal_workflow".
2. Note the name of the workflow that is specified for the object you want to control. If this is "(Default)", then the name is in the bottom field. This name is probably "plone_workflow".
3. Click on the "Contents" tab
4. Check the box next to the workflow you noted above, then click the copy button.
5. Click the paste button that appeared after you did the copy.
6. Rename the new workflow to something meaningful.
7. Click on your new workflow.
8. Click on the "States" tab.
9. For each of the states you want to change permissions for:
   1. Click on the state name.
   2. Click on the Permissions tab.
   3. Uncheck the " Acquire permission settings?" boxes.
   4. Change the other permissions as desired (or as shown below if you want to duplicate my workflow).
10. Go back into "portal_workflow".
11. Change the value of the workflow field to the name of your new workflow for any objects you want to have affected (or just change the default).
12. Click the "Change" button.
13. Click the "Update security settings" button.
14. Test the access on object types that use your new workflow.

Pending State

Private State

Published State

Visible State

Note that there may be more permissions available, depending on what products you have installed. However, the principle is the same for all of them.