Match each Appian object with the security inheritance rule that applies to it.

Process Models → Never inherit security; therefore, security must be set individually.

Documents → Always inherit security from their parent document folder.

Custom Data Types (CDTs) → Do not have security role maps.

Process models do not inherit security from process model folders, so their role maps must be configured independently. This is important because process models support specialized permissions such as Viewer, Initiator, Manager, Editor, and Administrator. Documents behave differently: they always inherit security from their parent document folder, meaning document access is controlled at the folder level. Custom Data Types do not have independent security role maps because they are used within the context of another secured Appian object. For example, when an interface uses a CDT, access is governed by the interface and the other objects involved in the feature. These distinctions prevent developers from assuming that every object follows the same inheritance model and support Appian’s layered-security approach.