Employee Self-Service - Employee Documents Access/Management

Summary

How do you secure documents about an employee from the employee i.e. access/management

Content

In Manage Document Records as an employee, I and other employees, have the ability to add documents.  How do we control what document types can be added by the employee?  If the employee adds the document or another administrative user adds a document for an employee or about the employee, how do we control whether the employee can see the document?  How do we control the employee's management of the document that can be viewed?  By that I mean, to allow or not allow employee to delete or update?