Block direct document access

I’m using Ditto to create a list of staff, but I don’t want direct access to the individual staff documents, which could be seen if you can work out the alias. Is the only way to do this to unpublish the docs, and override in ditto?

You can use weblogin for this. You can create web users which you can place in a webuser group which you can grant access to documents. Check this tutorial: http://www.packtpub.com/article/authentication-and-authorization-in-modx

It might be outdated, but I read through it fairly quick and it looked okay.

I think I haven’t explained myself very well.

Let’s say I have a document called "staff", which has a bunch of child documents in which each title is the name of a staff member.
In "staff" I have a ditto call which simply generates a list of those document titles. If one of those staff members is named "Arthur Brontosaurus", a visitor could type www.website.com/arthur-brontosaurus.html and find a blank page. This is what I want to avoid.

You could set the documents to unpublished and override ditto to list unpublished documents too by adding this parameter to you ditto call: &showPublishedOnly=`0`