...

/var/cache/tomcat5/work/Catalina/localhost/xmlui/cache-dir
/var/lib/tomcat6/work/Catalina/localhost/_/cache-dir
/opt/tomcat6/work/Catalina/localhost/xmlui/cache-dir
/usr/local/tomcat6/work/Catalina/localhost/xmlui/cache-dir

I changed access restrictions on a

...

collection, but restrictions didn't change on its items

You have to remember that access restrictions are inherited from its parent collection only when items are submitted, not when access restrictions are modified. So the new items submitted to that collection will have the collection's restrictions you set, but existing items will keep their current permissions.

...