Hi there
Did you eventually find a solution to this? My current solution to this, apparently, missing function is this:
<li> Have a main document repository, where all documents are secured PDFs. </li>
<li> All users' default permission in that repository is going to be "consumer". </li>
<li> There will be specific areas/folders within which users will have editorial rights. (This is possible since you can edit folder permissions, to not inherit those of the parent folder/site).
These areas will be where drafts are approved/rejected. Once approved, they will be moved into the main repository, where only the administrator will be able to edit them. </li>
<li> I have rules in these folders. E.G. a document that has been approved is automatically moved into the approved folder, and converted to a PDF. </li>
Note: I have been unable, so far, to find the area in Alfresco's settings that would allow me to automatically secure the PDFs, in the Alfresco conversion process.