Hi.
This looks like a typical case for using roles. First, create the roles according to your workflow (customer care agent, accounts-clark, …) and put the users in.
Next you can use a workflow action (like you already have) for setting document permissions for these roles in each state. There is one for Granting and one for Removing document access. So on each state transition you can add actions on entry/exit to set permissions for the next state.
Regards, Torsten