Answer
Adding a workflow to a Permission Set only grants permission to trigger the workflow itself — it does not implicitly grant access to the individual API tasks/projections that workflow calls internally; if the workflow contains its own API tasks, the user still separately needs the underlying projection/entity/action permissions those specific tasks require, granted just like any other API access, independent of the workflow-level grant.