Missing "new draft" tab (but visible "view published" tab)

My use case:
Content editors need to be able to edit all pages in one "section" of the site - but those pages need to be under moderation. The content editors should see "new draft" tabs on the content in their "Section" but not on the rest of the site.

Problem:
when my content editors have the "Basic page: edit any content" permission they are also allowed to edit any page that is outside their "Section" of the site.

When I take away the "Basic page: edit any content" permission, but grant my content editors the "Allow all members of this role to be assigned to Workbench Access sections" permission instead, and also add them as an editor (either by user name or by role) to their section of the site via workbench_access they no longer have the "new draft" or "moderate" tabs on the node pages they are supposed to be able to edit, but they do still have a "view published" tab. On the pages they are not supposed to be able to edit, they see no tabs at all.