Root cause of error " Access denied. You do not have permission to perform this action or access this resource" - workflow - SharePoint 2013

Question

Good evening, technet community
I hope you are doing well.
When configuring my SharePoint workflow, I encounter the problem below:
Problem Description:
Let's say my domain is: test.com, my group user is: test\group , my user is: test\user1
Except an admin account with full control at both "Web Application" and "Site Collection", all others account all have problem when creating a list item. After creating a list item, the workflow status is "cancelled" immediately
with the following message:
RequestorId: 262a35e4-99f4-40f0-929b-5d04b415f147. Details: System.ApplicationException: HTTP 401 {"Transfer-Encoding":["chunked"],"X-SharePointHealthScore":["0"],"SPClientServiceRequestDuration":["10"],"SPRequestGuid":["262a35e4-99f4-40f0-929b-5d04b415f147"],"request-id":["262a35e4-99f4-40f0-929b-5d04b415f147"],"X-FRAME-OPTIONS":["SAMEORIGIN"],"MicrosoftSharePointTeamServices":["15.0.0.4420"],"X-Content-Type-Options":["nosniff"],"X-MS-InvokeApp":["1;
RequireReadOnly"],"Cache-Control":["max-age=0, private"],"Date":["Thu, 06 Nov 2014 12:14:28 GMT"],"Server":["Microsoft-IIS\/7.5"],"WWW-Authenticate":["NTLM"],"X-AspNet-Version":["4.0.30319"],"X-Powered-By":["ASP.NET"]}
{"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform
this action or access this resource."}}} at Microsoft.Activities.Hosting.Runtime.Subroutine.SubroutineChild.Execute(CodeActivityContext context) at System.Activities.CodeActivity.InternalExecute(ActivityInstance instance, ActivityExecutor executor,
BookmarkManager bookmarkManager) at System.Activities.Runtime.ActivityExecutor.ExecuteActivityWorkItem.ExecuteBody(ActivityExecutor executor, BookmarkManager bookmarkManager, Location resultLocation)
- The workflow is still fail even I assign "full control" to my users group "test\group" – at Site Collection level.
Surprisingly, I have successfully found a solution for this error message. However, I still have some points that I do not clearly understand. Let's start with my solution first.
Solution:
*** i. Assign permission policy at Web Application level – Central Admin site ***
1. Central Administration ==> Application management
==> Manage Web application 
2. Go to "permission policy", then create a new permission level. This permission level contains all "edit item" permission.
3. Select "user policy", then I assign it directly to my user account: test\user1.
*** ii. Assign "edit item" permission at Site Collection level ***
1. Site Setting ==> Site permission
2. Assign "Edit" permission to my test\group.
(Actually I removed all permissions of my user group at Site Collection level. It seem my group has inherited permission from Web Application level, is that correct? )
*** iii. Create a new list item and workflow runs ……. ***
==> My question is:
1. Why I cannot assign permission to my users group - "test\group" -
 at "Web Application" level? Instead I have to assign permission policy for each users, one by one?
2. Could you please let me know how to collect full detail error message of workflow status?
Thank you very much! Have a nice weekend.

Answer 1

Thank you for your very detail response.
Point 1: Yes my 2 service: user profile & profile sync service are running. I performed "full synchronization" as well. Actually i've tried 3 another action plans before coming up with the solution i posted:
*** Actions completed ***
1. Activate the feature: workflow can use app permissions.
Site actions > Site Settings > Site features >activate the feature below:
 Workflows can use app permissions
2.
Refresh trusted security token services metadata feed
Get-SPTimerJob
"RefreshMetadataFeed"
| Start-SPTimerJob
- then restart the machine.
3. Start full user profile synchronization.
Point 2:
- Yes my user had Edit permission at workflow task list + list affected by workflow.
I have just remove all permissions of my user at "Site Collection" level. However, when i show my user permissions at my workflow task list and my users still have "Edit" Permission ( assigned at Web Application level. These permissions
still exist even after my workflow task list stop inheriting permission).
==> the problems probably belongs to "permission" at "Site Collection level". It seems "permission level at my Site Collection does not work". All users accounts are also suffer from the same issues except farm admin account
( which has full control at Web Application level).
I would appreciate if your guys can guide me how to make "permission" at my "Site Collection level" work again?
Thank you very much.