I have a question about permission activities.
I tried to implement something similar(after item is changed or added assign specific permissions on item) but i encountered problem:
i have custom console application which updates some data in lists and after calling item.Update()(or any other version of Update method, for example SystemUpdate()) it triggers workflow(in first implementation it was asynchronous receiver).
But this workflow(asynchronous receiver) is hosting in thread of console application and console application does not know anything about thread of workflow.
And when console application closes it shuts down all unfinished workflows(asynchronous receivers), so permissions are not granted.
How i can resolve this problem? That's why you are using service to grant permissions?