In Revolution.we create a Static Resource (
http://rtfm.modx.com/display/revolution20/Static+Resource), the alias of which will be seen by the browser, and we place this static resource in the appropriate Resource group. We save it, and then we edit it and point it to the file.
To add additional content types, you can do so under System/Content types.
http://rtfm.modx.com/display/revolution20/Content+Types
Under Settings you'll need to set your Content type to the correct type of file (it will add the extension automatically to the alias).
So for example we'd create a container document called: boardmembers
Under that we'd create a series of Static Resources for each file so if it was team.doc the url would be: site.com/boardmembers/team.doc. The alias for the static resource would simply be team.
If you go to that when not logged in and it is locked out by belonging to a resource group, a user won't be able to download the document. When you are logged in you'll be able to download the document. You have to use the Static Resource field to point to the actual document.
So presumably, if we have site.com/boardmembers/team.doc as a resource url and we also put the actual team.doc document in a physical folder of the exact same name maybe then MODX would override the physical folder thus protecting it.