SSRS reports access management

I am using SQL Server 2019 Reporting Services. One consistent issue I have been running into is that when I grant access to a report to a new user, the user is able to see folders and reports that he/she was never granted access to. He/she can't run the report but they can still view them. We use on-prem AD. Has anyone else had this issue? What's the resolution?