I'm not a network admin, but I was able (with help from our network folks)
to create a document  folder called Private. I gave the coordinator right to
our CTO, and author rights to two others. Any folders they create underneath
will inherit these rights.

Then, in IIS, I opened that folder  and denied access  to the folder to
everyone in the company  but those three people. When anyone but the three
click on that folder, they get a customized error message indicating the
resource is off limits. Of course I had to be given rights to the folder
WHILE I CREATED IT AND PROVIDED THOSE SECURITY SETTINGS, but once they were
there, I could remove myself (actually removed my IP address) from access.
Now there's a secure lockdown on the folder that should be sufficient for
our purposes. I have no illusions that someone with abilities couldn't get
in, but they'd have to work at it, and I believe a breach would be logged.

If anyone can think of an obvious way this is insufficient, I'd love to hear
that.