Plone5 view permission depending on permission of folder - plone

Question

I'm trying to deploy an "intranet" folder hierarchie with a simple workflow, that:
shut of anonymous users from that hierarchie, even sub-levels
let users of a certain group enter that hierarchie only, even sub-levels
have private objects unvisible by default
upon publishing make them visble to all users of the group
private folders should deny other users (except admins) to enter that folder and access any object below
This scenario is discussed here: http://blog.keul.it/2011/10/plone-security-and-workflows-learn-how.html?m=1
It's more or less the same here: Plone Intranet workflow and group permissions
The answer of the question of above is:
Leave the page or folder in the private workflow state, NOT published internally. (I think this is the step you were missing.) 2.
On the Sharing tab for the page or folder, grant 'Can view' to the
group you want to share with, just like you already tried. You don't
have to change the "inherit permissions from higher levels" checkbox.
However, if I grant 'can view' only, the user may not enter the folder, but if I grant 'can add', too, the user may enter. However, this makes all objects below visible to all users of that group.
Example:
user is member of group1
folder in private state
-> share with group1 'can view'
user may not enter folder;
-> share with group1 'can add'
user may enter and sees all object, even private ones
This is Plone 5.0.6, should this setup work?

Answer 1

Here is a reminder in general, though it might not answer the question per se.
1) Make sure you configure the 'real' target on its Sharing tab. For example, a folder with a default view might mislead the target. 2) Likewise, items with index_html IDs in a folder will become the default view, that might mislead the target. 3) Can View in the Sharing tab means Reader role in the workflow settings. Check permission settings in Workflow State. The following is my example settings hopefully gives hints.