Disclosed are systems to apply customized permission settings to protect particular portions of a document, and, in particular, documents that are of bitstream datatypes, encoded or not encoded, e.g., an audio filetype such as the MP3 audio format. The custom access permission settings may be implemented by obfuscating the protected portions of the original bitstream and then embedding “secret,” e.g., hidden and/or encrypted, versions of the obfuscated portions in parts of the data structure of the original file, e.g., in the form of “layers” that are held within audio stream containers such as channels. The content of the individual encrypted audio stream containers may then be decrypted according to each recipient's permissions and layered on top of the obfuscated portions of the encoded media file before being rendered to the recipient.