Without more information, I would say use Lifecycle States with Ad Hoc life cycle state rules such that in a particular state, certain groups or roles can "read" something, but in another state those groups cannot "read" that same thing. That way the same object type can be in a "Read" state or a "No Read" state and you can tell by the name of the State. For Example, "Released" might be read-only for all usres, but "Obsolete" might be limited to only Admins, and all other users cannot see it because they don't have the ad hoc permission in the Obsolete state that they get inthe Released state.
You can use Actions-->Set State as an admin to set the state back and forth as much as you like. Or you could get more formal and use a change process to release documents from one state to the next. Or you could use promotion requests. Etc. Etc.
Al
