Edocman permission problems

We have a document set for registered access. It is in a category that is set for registered access. If a user is not logged in, but he knows the link to view or download the document, he can access the document. This would indicate that base level permissions are not working. In other words, you are protecting access to the link, but not protecting access to the document.