Assign custom permissions to non-folderish objects

Recently I noticed that not all permissions are available on all content types, e.g. on ATDocuments (probably all non-folderish objects).

You can see this via the permission tab of the ZMI:

ATFolder: http://localhost:8080/path/to/atfolder/manage_access (all available permissions)

vs.

ATDocument: http://localhost:8080/path/to/atdocument/manage_access (just a few permissions)

Custom permissions (defined via ZCML) are also available on ATFolders but not on ATDocuments (at least).

My biggest problem is, that I can't set the missing permissions via a workflow state to ATDocuments (actually 开发者_Go百科I can but it seems to has no effect).

Here is my question before I digging into the code: is there a common way to make custom permissions available for ATDocuments (or other non-folderish objects)?

BTW: this occurs for Plone 4.0.5 (I don't have checked others yet).