Knowledge permissions are set per article and child articles inherit from their parent unless you change them, which explains what you are seeing.

• Open the restricted article and click Share at the top right to manage its access.
• Set the default access for internal users to No access, then add HR and management members with Can edit or Can read.
• If the article sits under a parent visible to all, change its own permission so it no longer inherits; Odoo will ask you to confirm the restriction.
• Alternatively, create a separate root article for confidential HR content, restricted from the start, and place sensitive children there.
• Test by logging in as a regular employee, or ask one, to confirm the article no longer appears in their sidebar or search.

Keeping confidential content under its own restricted root article is usually easier to maintain than overriding permissions on many individual children.