I don't understand if this is an OOP or a DB question...
in reply to managing object permissions
> For example, if a Desk is in a Workflow, I'd want the Desk to inherit permissions from the Workflow.
Sounds like you're adding the Desk-object to an array in the Workflow-object. The add-method might take care about dublicating rights, or adding a backlink in Desk to Workflow which is dynamically followed, if Desk's rights are evaluated.
... just my 2˘ of brainstorm interpretation of your question...