On Facebook, how can I restrict access only to a specific group, and later on, withdraw access?

I have a document that I want to make available only to the people it is about. I did a test, and tagged someone in the document and they were able to see it. But then I removed the tag, and they were still able to see it.

I have no confidence in the privacy functions of Facebook. I’m not even sure that my document is truly private (I restricted it to “only me”).

I’m thinking of setting up a list and restricting the document to that list. But I still have the same issue—will I truly be able to restrict it only to that list (at least via Facebook—I can’t control what people with access to the document do with it)? Will I be able to withdraw access from someone who once had access?

How can I accomplish these goals?