Perhaps not the most intuitive feature in Episerver, but the default behavior is to inherit ACLs from the parent (much like Windows ACLs). This means that if you change settings on an item, all subitems that are inheriting will be affected.

If you check "Apply settings", it will add/merge perms on subitems that are not inheriting. Subitems that are marked for inheritance are not affected. Read more about it in the docs.

That explains everything :)

Thanks!