Okay, I switched all my connection profiles back to the way they were prior to the onset of Active Directory (they now all use a LaserFiche account will full rights to everything).

I started my form submission/workflow approval process from scratch.  Everything was fine, all the proper permissions held.  A member of an Active Directory group called Department had access to the repository and all the folders in it.  It had inherited permissions on this folder sub-folders and documents. 

It looked good until that user triggered a workflow that specifically gave permission to an AD group that, until this time, could not see the folder in the repository.  The only difference in this workflow from before is that it used to give permission to a LaserFiche group, not an AD group. 

Suddenly the original AD group (Department) that could always see these folders before, lost rights to it.  It disappeared from view.  When I logged in as Admin I can see the folder and the AD group with the newly-added permissions can see the folder but Department group cannot.

The workflow that was triggered did not remove any permissions from anyone.  is there someplace I can look to see where this is happening?

In addition to the above, the Laserfiche user I used in the connection profile, who, prior to the triggering of this workflow had all rights on every folder and every field (I verified this) has now lost the ability to modify the fields.  it can read them but not modify them.  Its laser-fiche group is now missing from the list when I check the access rights on the folder.  strange - it has admin rights so I can actually check the access rights on the folder but it is not in the list and the fields in the template are all greyed out.  Bizarre.