Reporting Services allows many nested levels of folders, just like Windows, and when you apply security settings to a folder the settings flow down to child items - which can be other folders, reports, and items like Excel or Word files. However when you change security settings on a child item you disengage it from the parent, so that any changes from then on to the parent won't affect the child (unlike Windows security, where you can "inherit" the parent settings and add child settings).
In my mind this makes security settings in Reporting Services hard to keep track of. Items...