I'm very new to SharePoint 2010, and I've been working on a workflow for folder permissions that replaces all permissions so that only a certain group is given Contribute access to the folder. This seems to work as it should - users who aren't in that certain group seem to be given Limited Access as a default, and so can't see the folder when they enter the document library.
However, the problem is that when they access the folder through a direct URL, they're able to see the folder instead of getting "Access Denied".
Additionally, in the workflow, I also have it set so that non-Folder items inherit permissions from the folder. When users who aren't in the group type in the URL to these documents within the folders, they're correctly shown "Access Denied".
So the permissions seem to work correctly for documents within the folders (so that they're inaccessible even with a direct URL), but somehow a user who shouldn't have permission is able to access the folders themselves with a direct URL (so they see the folder itself, but not the contents within). I've tried removing the groups with Limited Access entirely so that the user's "check permissions" for the folder is none, but they're still able to access it through URL.
Any advice? I'm pretty confused as to why this is happening, and how I can fix it.