Files in classic collections
Check the file’s Settings → Distribution → Share to. With Inherit, a person can access the file through a classic collection they can open. For an automatically populated collection, its saved rule must match the file.
If a file belongs to several collections, access through one can be enough even when another is restricted. The person does not need access to every collection.
Check each relevant collection’s Settings → Sharing. A file’s own All users, Specific users or Admins only setting is separate from collection inheritance.
Files without classic collections
An Inherit file with no classic collection memberships can use a library’s Share inherited assets with all users setting. Open Settings → Assets → Display for the library; older settings views place it directly under Assets.
This default applies to signed-in account members. In libraries with their own audience controls, the person must also have access to that library for its default to apply.
If the file belongs to several libraries, an applicable default from any one can grant inherited access. With no applicable grant, Inherit does not automatically make the file available.
Folders and other grants
Do not assume that putting a file in a folder copies the folder’s audience to the file. Some older Drive views also have folder publishing rules.
When reducing access, check the file’s own audience and previous group assignments, its collection memberships and its library defaults. Administrators and uploaders may have additional access. See Change who can access a file for the exact controls.