There is a content type for accepting job applications, including resumes and cover letters as files uploaded. The files are set to private.
The form/page is set to unpublished by default - largely to 'fix' some other wonkiness.
Users with admin privileges have no trouble downloading the resume and cover letter files.
The more limited users in HR cannot - Drupal returns a message
You are not authorized to access this page.
I've been tweaking permissions trying to find the magic bullet. The HR user can 'Edit' the individual's application form, but even though the associated resume or cover letter file is shown as a link, once again, the HR role is not authorized.
Any ideas what permission I need to toggle? What's blocking the ability for the HR role to download the file?