Non admin has access to closed category

Ok – so found the problem.

Maybe this is a bug? That post was under a child category in a private parent category. But when I created the child category within the private parent category, it did not keep the permissions.