add workflow state to fields returned by permissions query