Security and Access Control
Core concepts
Appian security layers: authentication (how users log in), authorization (what they can do), and object security. Know groups (nested), roles, and object-level security (viewer, editor, administrator) on record types, process models, and interfaces. Understand record type security including row-level security via record-level security and field-level security.
Process and data security
Know that process model security controls who can start/see processes, and task assignment controls who receives work. Understand data store security and how query results are filtered by the viewer's permissions. Be clear on service accounts and system users for integrations.
Traps
- Assuming object security alone restricts data rows - row-level security is separate.
- Forgetting that nested group membership grants inherited permissions.
- Confusing administrator object permission with system administrator role.
- Overlooking that integrations run as a service account with its own permissions.
Worked rule of thumb
Grant the least privilege: put users in groups, assign object permissions to groups (not individuals), and layer record-level security for row filtering. Test with a user in each group to confirm visibility, because inherited permissions can widen access unexpectedly.