There might be some clever things you can do with webservices but I like the simple method of a new collection and set the privileges correctly.
Another idea, you could use knowledge management and knowledge domains?
Thank you for your answers,
I'm thinking that simplicity is best too so will probably go for the additional attachment object although I need a good reason to learn a bit about the web services side of things
I'm using a ;bit of Event Management but i don't think that's quite the same
I'm not sure how that you'd use knowledge domains to do that though. I'm trying to restrict access to docs whilst still attaching them to incidents but I have to say that I haven't looked at knowledge in any detail as yet