Dynamically securing paperclip attachments on s3 depending on file mime type

I am adding functionality to an existing application that has been used to upload public images via Paperclip into AWS S3, that works fine and dandy. My problem is, the new functionality requires that if a user uploads documents that are not images then those documents need to be secured. Currently my default configuration for Paperclip does not include :s3_permissions => :private because it has never been necessary.

I am essentially trying to conditionally secure files depending on what mime type they are. Is it possible to do this? I've read the documentation but can't seem to find a good way. The only idea I have right now is to do something like this:

  def secure_if_document
    if %w(application/pdf application/msword text/csv).include?(file_content_type)
      DEFAULT_PAPERCLIP_CONFIG.merge({
        :s3_permissions => :private
      })
    end
  end

But I'm not sure at what point I would be able to inject this configuration dynamically. Any help would be greatly appreciated.