I don't understand if this is an OOP or a DB question...

> For example, if a Desk is in a Workflow, I'd want the Desk to inherit permissions from the Workflow.

Sounds like you're adding the Desk-object to an array in the Workflow-object. The add-method might take care about dublicating rights, or adding a backlink in Desk to Workflow which is dynamically followed, if Desk's rights are evaluated.

... just my 2¢ of brainstorm interpretation of your question...