When Can Users See Content Even If They Are Not on the Access Control List

1. For the security group of the content, is that security group listed in the config entry SpecialAuthGroups? Like SpecialAuthGroups=Secure 2. Does the user also have the admin role? If so, this overrides the ACL. 3. Does the user also have admin permission to the security group the content is checked into? If so, this overrides the ACL. See this Note: Note 1613513.1 - When Can Users See Content Even If They Are Not on the Access Control List?