Disable download file based on related object

I have a scenario which requires a specific type of access:

1. Users are assigned to one or more identities, representing the Projects within the business.
2. Generally, access to an object using the OOTB permissions  object is an OR scenario. Once a user has been granted access to an action or object, then further checks are not required.
3. IP license agreements are entered into by the organisation. These agreements control who can see the contents of the agreement and documents whose access is covered by the IP license.

The concept I have is:

1. Each user in the system is accessible, similar to the Program Management use of users to receive assignments.
2. An 'IP License Agreement' object are created. This object may have files checked into it.
3. A relationship is defined between the 'IP License Agreement'  and the users that can read documents described by the 'IP License Agreement'
4. A User can be related to multiple 'IP License Agreement' objects.
5. A Document can be related to multiple 'IP License Agreement' objects.
6. All Users in a Project can see that a document exists - the document's filename, format, size etc
7. If a Document does not have any relationships to an 'IP License Agreement' object, then the OOTB ARAS permissions of Can Discover and Get apply.
8. If a Document has a relationship a 'IP License Agreement' object, then
   1. if the User is not related to the 'IP License Agreement' object', then the user can only see that the Document exists. The User cannot download the Word or PDF or Excel file attached to the Document object.
   2. if the User is related to the 'IP License Agreement' object, then the user can download the Word or PDF or Excel file attached to the document.

The above scenario and schema can be maintained by any user who can Add and Update the 'IP License Agreement'. For example, the commercial manager could manage the creation and assignment of the 'IP License Agreement' objects. An Innovator Admin role shouldn't be required. By using an 'IP License Agreement' data type, the OOTB History will record when users are added/removed from accessing the 'IP License Agreement'. Also, the OOTB History record will record when users download the attached files. The above 'IP License Agreement' scenario controls access through

• Is the user permitted to Get and Can Discover through the identity/permission access?

AND

• Is there a related 'IP License Agreement' that should be evaluated to determine the ability to Download the file?

And advice on how to implement the above conditional download capability would be appreciated.