Hi Alex,

You should be able to control access to workbench using the basic controls on Servicenow platform, such as

- ACLs: Access control rules

- UI Policies: Create a UI policy

- Client Scripts: Client scripts

- Data Policies: Data policy

I would start with ACLs.

You can   create new roles to work along with the OOB 'it_demand_manager' and 'demand_manager'. After you create the new role you can use it on ACLs, and other pages where you can control the users access.

Since you do not want to change OOB configuration, you could find the OOB ACLs for the workbench tables use 'Insert and Stay' functionality (right click on the ACL form header and select 'Insert and Stay') after making changes on them.

Let me know if perhaps I misunderstood your question.

Best