Keychain best practice

I have an app that can open encrypted documents. To make it easier for the user, the app can save passwords for these documents in the keychain, using the Keychain Services API. My question here is about how to best create the password items for these documents.

First if all, these documents have an unique ID, which can be be seen before decryption. I want to use this ID to identify the item in the keychain, rather than e.g. the path to the file, as the filename can easily be changed by the user without changing the file contents. 

Also, I have red the docs, and know how to create and find keychain items, including (slightly) more advanced features like custom attributes, and have done so successfully. So that's not really what my question is about.

My question is more about: what should I use for the various attributes, such as service, account, and perhaps label, description and comment?

Currently I am using the user name as the kSecAccountItemAttr and "MyApp - <document ID>" for the kSecServiceItemAttr. I am also setting the kSecCommentAttr to the file's path so the user can see which file is associated to the item in Keychain Access.app (for instance if he wants to manage them). That does work well, but I wonder whether this is the correct way to do it. 

For instance, I could also use some description like "MyApp Document Passwords" for  kSecServiceItemAttr and the document ID for kSecAccountItemAttr. Or perhaps the other way around. 

Also, could it be acceptable/useful to use a custom kSecDescriptionItemAttr of kSecDLabelItemAttr? I was thinking of a description something like "<Type> document password" and for the label perhaps the file path or the document displayName. Does this make sense?

thanks,
Christiaan