One problem that I see with

role-based (this means only users with the same roles can view these documents)

is that if I create a document with this type as an intern, and later get promoted to a staff position, will that document be visible to the interns or to the staff?

I'd rather set the access_type field on the Document itself, and use the DocumentPermission entity to specify which roles have access to a certain Document (if the access type is role-based).

One problem that I see with

role-based (this means only users with the same roles can view these documents)

is that if I create a document with this type as an intern, and later get promoted to a staff position, will that document be visible to the interns or to the staff?

I'd rather set the access_type field on the Document itself, and use the DocumentPermission entity to specify which roles have access to a certain Document (if the access type is role-based).

Also (but that is my opinion, I've seen more implementations like yours), I'd put the roles (superadmin, admin, staff, intern) into a separate entity, and have the UserRole entity link to that entity instead of the role_name column. Your design might save you a join, but in the end it's less flexible.