I encountered an error regarding permissions when using workrooms in EPiServer 4.61. If you add a user as a member of a workroom, and then remove that member, the user in question still has Read, Create, Change, and Publish rights on the workroom. As a result, the user in question can see the workroom in the workroom list. He or she can then click on the link to the workroom and ends up on a blank workroom page. I believe that the desired result of removing a member from a workroom is that said member will not see the workroom in the workroom list and that all rights should be removed for that member. I found a post partly addressing this problem, http://www.episerver.com/devforum/ShowTopic.aspx?id=4015&epslanguage=EN, with reference to issue #34136 which was resolved in the 4.51 release.