Thanks for the pointer.
I’ve installed the ‘Category Levels’ plugin and it seems to do the job pretty well. I couldn’t find an intro on the web, so I’ll explain a bit for the benefit of people who need to do the same thing as me:
The ‘Category Levels’ plugin can deny persmission to, or completely hide, the categories and posts from all users who are below certain user-levels.
So, you can configure it to either make the posts disappear altogether (this is my personal preference), or display an access-denied message to underprivileged visitors.
If you opt to hide the posts (and this is the default funtionality), the protected posts and categories will only appear when the user is logged in with a sufficiently high user-level. For other visitors there is no clue that these protected posts exist. Even if you access the hidden posts directly (via a saved URL) then WordPress will act as if they dont exist.
The plugin is based on the 10 user privilege levels that are already built into WordPress.
The only major improvement I would like to see is a permission system based on user groups rather than the more restrictive permission levels.