Item level permission from it's native parent. We convert files are uploaded by end user to png put it in "PNG" folder of that document library. There are bunch of other folders (_Private, PNG, Public, Finance, HR) within a document library (including png folder which has read access to all the custom groups).
When HR uploads a file (i.e. payroll.xls) into their folder "HR" then it gets rendered to PNG format (payroll.png). Rendered file resides in the PNG folder. I like to inherit permission from HR folder and apply it on the rendered png file so that only HR can see payroll.png when HR go to "PNG" Folder. The file should not be visible by unintended group(s).
Hope it's making sense.