Best practices in implementing CRUD model for attachments

Hi Community,

We have a project with complex CRUD model for attachments of an object.

For example after a certain active stage, all CRUD operations should be blocked

Attachments are being stored in the sysfile object as per the new attachments architecture of Creatio since I believe v8

This approach does not enable flexibility for object permissions as what you define for the sysfile of that object will be applied to all attachments in the application.

In the past what we have done is to close the possible CRUD operations via front end, with business rules and custom code.

It will also be possible to do this via process, record by record

As anyone had any experience with this type of implementation and what has been implemented?

Would it be advised to create a separate attachments object to use the "standard" access permissions?

Thanks,

Luis