AuthZ: Permit metadata access but deny (some) file access

Title (Goal)	Permit metadata access but deny file access
Primary Actor	Repository architect
Scope	access
Level	High
Story	I want to "lock down" the full-resolution or full-text or OCR files (formerly datastreams) so that only certain users can access it, but allow other users to view the object's metadata (and perhaps other related files like a thumbnail or low-res image).

Examples:

Islandora Scholar Embargo - does this on a timed basis (implemented at UPEI and elsewhere)
From Kelsey: "Copyright protected and limited distribution records have XACML policies restricting access to the OBJ datastream to Admin only."
"Signature" datastreams - scans of people's signatures and release forms - are not for general consumption.

Islandora / documentation