Trying to allow downloads by role...

Thank you for this module! - I'm really hoping it will help me but am clearly not understanding usage. For example:

I create a role testRole, and a private files subdir testRoleDir with one file in it.

I have a content type dataFile with title, attached file, and metadata. I create 3 pieces of dataFile content using 1 file from /private/testRoleDir, and 2 files from elsewhere in private/dirs.

If I remove private file access from testRole in the general role permissions, but enable access to a private/testRoleDir for that testRole via your module, I can see all the titles/metadata but can't see ANY file links when viewing any dataFile content as testRole.

If I enable private file access from testRole in the general role permissions, I can see all the titles/metadata and ALL file links when viewing any dataFile content as testRole, and I can download any file (NOT what I want)

if I make a view page of all dataFile content, then I can see info from all 3 pieces of content, including file links, but only the file in the testRoleDir can actually be downloaded. This is kind of what I want, but I'd like the unavailable files not to show at all.

I'm sorry this is so long... can you see anything obvious I might be doing wrong? Should the private file permissions work on plain content as well as in views?

Much appreciation for any tips you can offer!