Document level read permissions junction table?

I need to control at the document level what the user type of SubClient sees in a list when they log in.

I have tables userTable and docTable. The app is just a team document app. Manager logs in and sets up a Client and under that client are associated documents and subclients of any number but generally both are around 4 or 5. Clients, subClients and docs comprise a group. One to Many for clients=>subclients and clients=>documents. Unidirectional.

I have this UI to control what PDFs a 'SubClient' sees when they log in. From a database standpoint the best way to handle document level read permissions is a simple userDocJunctionTablewith userID, DocID, AccessRightCodefields.

I feel like I'm not thinking of something and every example I find is overly complicated for this app, like databaseanswers.org/.../document_management_for_security.

JIC it's a Yii2 app with DB based RBAC auth.