how permissions work in orchestrator

Hello,

there is something I do not understand very well

permissions on VCO

I have decided to give rights to domain users on the root folder of vco to allow them to see vco on vCenter

and on each folder I create for teams I give no rights to domain users and view,inspect,execute rights to the team

this work well throw vcenter even if one of the workflows use an other workflow stored in a folder where the user does not have rights

this is to prevent the users to see the workflows of other teams and the library workflows

but this does not work in orchestrator itself

can someone help me to figure out how vco works exactly with permissions?