Thanks, @Sven-iX. Unfortunately, it doesn't work since the assignedToID only looks for the primary assignee, and the sponsor could be any of the assignees.

This is an older post, but I've recently been researching business rules for custom form updates that need to happen in different phases of projects.  

Basically, the users are inheriting access to the documents through object-level permissions, which gives them access to open the proof as well. Try playing with object-level permissions or locking down inherited access to documents through the access level.