I have figured some of it out. It seems it is set by the parent category.
I see that some categories have the following value set:
"read_restricted": true
I am trying to figure out to determine which groups have read access to which categories.
I am brand new to Discourse and trying to figure it out.