Custom content access question

I have an access control use case that does not appear to be suited to any of the contributed access control modules out there, so I am considering writing my own custom module, but as I have never done so before would appreciate a sanity check.

The use case is as follows:

I am using Organic Groups to create Project nodes which are private groups and content posted to the project is only visible to members of the project.

While there is only one "project" OG content type, there are actually many different kinds of project (for the sake of illustration lets just say that there are only 2 - "standard" and "custom"). I can't have a separate OG group content type for every project type (e.g. instead of having one "project" content type, having separate "standard project" and "custom project" content types) as this will be very cumbersome in the long run. So I need to have only one "project" content type and be able to set what type of project it is by a CCK field, so when you create the project.

Independent of the project types is a set of documentation that I need to share with users. While a lot of documentation is shared between content types, some documentation should only be visible to certain project types. In this case, users that are members of "custom" projects should not be able to see "standard" documentation.

This is where the problem comes in - this restricted documentation has to be restricted according to the project type, but I obviously can't upload the document into each and every group of that type.

As I said, none of the popular content access modules work for this particular case, so it's looking like I will need to write my own module, and it will need to go something like this:

1. The project, document and user profile content types all have a common "project type" CCK field.
2. Users can only be created within the context of a project and they inherit the project type from the project as a profile CCK field.
3. When assessing whether or not a user can see a document, the module will need to compare the user's CCK field with the documents CCK field and if they match, access is granted.

However this seems to be at odds with the way permissions in Drupal works (it can't seem to be done on the fly, it looks like the permissions needs to be saved in some way).

I would massively appreciate anyone with more Drupal experience than I reviewing the problem case and letting me know if I am wasting my time going down the module route I described. After a couple of weeks looking into this it does unfortunately appear to be my only option.