By default, every folder has “Allow” access assigned to the “Everyone” group. Assign “Allow” access to other groups by dragging them into the “Allow” section of the folder editor.
When groups are assigned to folders, the reports and dashboards belonging to those folders will only be accessible to users that belong to the assigned groups.
Folder Permission Inheritance
Folders inherit “Allow” access groups from their parent folders in the “Information” view (i.e. Report Folders and Form Folders). A child folder can be assigned additional groups that do not belong to their parent folders (e.g. Utilities is a child folder to the Engineering folder):
In this configuration, even if the Engineering user group is later removed from this folder, the users in the "Utilities" user group will still have access to the forms/reports, because the have been explicitly given access.