you will need to use 'Set item permissions' action which allows you to do exactly what you want.

keep in mind though, to (re)set correct permissions for every approval step as well as to restore resp. set appropriate permission before you end your workflow.

Marian Hatala​, thanks for the response.

If i use set item permission, it will break the inheritance from parent, how can i add this inheritance back once the approval is completed. my application is kind of getting around 30 requests a day, and i do not want to exceed the 50,000 unique item permission limit.

I would say using set item permission action and configuring it to 'Inherit permissions from parent' to YES.

but to be honest, I've never tried it. if I needed to play with item permissions I usually ended up setting some specific item permissions after approval. so, once I dropped inheritance I took carefully care to set proper permissions over and after the workflow life cycle.