Well, there is a difference in "see" and "view"! Joe can see the Agent folder but he can not view/access the folder. Based on this interpretation, I got it wrong...