I need customers to be able to access certain documents (PDFs mainly) specifically for them (they contain sensitive information). The document information is setup in nodes. I have looked at a lot of access control modules, but they all seem to focus on user roles. I don't want a role for every customer. What would be the best way to structure this?
A possible (but somewhat convoluted) solution could be to use Node access user reference module with private files setup. Basically adding a user reference to a node will allow them to see its content (including files) and having files' folder protected will prevent direct access to the file urls.