Ok, so you would be using folders for security within a single library. That is a valid reason for using folders, but it would also be very cumbersome, because then you'd have to break inheritance on each folder and manually configure each permissions for each person who has specific access to a given folder. That sounds like a bit much. Here is a possible workaround:
- Keep all forms in one library with one set of permissions
- Create text data elements in the form for the submitter and the submitter's manager
- Populate the submitter field with userName() as a default value
- Populate the manager field using the Manager attribute of the GerUserProfileByName method of the UserProfileService as a default value (this only works if the manager attribute is populated in AD and is being pulled to SharePoint via the profile import. If not, then you will need an entire custom list made that associates each user with a manager. If it's just one group of managers for everyone and is not specific to the users, then use a Contact list that is restricted and only lists the managers, then you can make a data connection to this list to verify whether any current user is a manager or not).
- In your Form Options, create a rule that switches the view to an "Unauthorized Access" page within InfoPath for any user who doesn't match the Submitter or Manager
- Change (or create anew) your default view so that it only shows forms where the current user ([Me]) is the submitter or manager (promote those fields)
This way, people only see forms in the library where they are the submitter or manager. And, if they get the URL to another form where they shouldn't have access, they will simply be shown a blank page (view) with some sort of message and a close button.