Download permission per object, not only per role

Problem Today "Download Files" is one switch per role, and it covers every file in the workspace. We can't say "this role may download commercial offers, but not contracts". We have to either block every download or allow sensitive files to be downloaded too. Example Our sales team should download the PDF offers they send to clients (files on our "CDR offer" object). They should only preview signed contracts (files on our "Contract" object), not download them. One switch per role can't express this. Proposal 1. Add a "Download files" box next to Read / Update / Delete in each object's permissions within a role. The role's general "Download Files" switch stays as the default. 2. Files, notes and tasks linked to a record follow the download rule of that record's object. A file on a Contract follows the Contract rule. Attachments, notes and tasks already take their visibility from their parent …