documents seem to inherit permission from root folder, but not it's immediate folder.
For example, let's say we have the following folder structure within Document Library:
MyRootFolder/ -> MySubFolder/ -> MyText.txt
User sets MyRootFolder to have Guest view permission.
User sets MySubFolder to be viewable by users with MyRole role.
(User also configure Document Library portlet instance to use MyRootFolder as The ROOT FOLDER for this portlet)
It turns out that users withOUT the MyRole role was still able to search for the MyText.txt file, even though MySubFolder is only viewable by users with MyRole.
If we change the MyRootFolder to be viewable only by MyRole users, then non-MyRole users doesn't see it in the search results.