What governs view access?
There are two things which govern access to views and their results.


The access settings for the view. These are found on the view page and can be based on permissions or roles. This is a base rule for who can see this view.
The access settings for the content being displayed by the view. This is definitely where things get a bit funky. Essentially, views doesn't collaborate with Drupal permissions or hook_node_access(). It will show content users might not have the permission to see or content that has been safeguarded by hook_node_access(). That makes these two methods pretty useless for protecting content.


What actually happens is that views queries the {node}, {user} or other entity table and retrieves nid's, uid's or other entity id's. At no stage does it check permissions or hook_node_access(). However, when checking nodes it does join with the {node_access} table to determine if that system has any rules about the content. Note that hook_node_access() doesn't really have anything to do with the node_access system.

By default you probably aren't using the node_access() system, but if you are using a module like content_access then you are using this system and it may be restricting views results.

If you have devel module installed, you can use the block with the title Devel node access and place it on a node page. Now when you visit that page, it will show the roles and their access level. Note that you need to access that nodes page with a user with that role before it will show in the block. This is the access record which will determine if the node can show in a views result.