SelfService article search returns articles in classes the user cannot view

Ah, I see now. I had given Unprivileged global “ShowArticles” rights. Once I removed that and added the right only for appropriate customer groups it works the way I wanted.