(Dont) see a content item in /folder_contents

Plone 5.2. What is the correct permissions to set to avoid a 'private' content item to show up in /folder_contents?
With current workflow, I can see it, but I can not (click on it) view it (Insufficient privileges). Does it make any difference whether the content item is folderish or not ?

Can the permissions be set on the content types themselves ( dont show me in listing) ? or do you need to do it on the folder?