Secure Data for Process HQ

This page applies to developers, system administrators, and data governors. It describes how to secure your business data in Process HQ.

Before securing business data, review the different user roles involved in Process HQ and how they work together to secure data."

Overview

Process HQ is powered by your business data. You can use any synced record type in your environment as a dataset and as process data:

• Use datasets to explore your data in reports and dashboards with data fabric insights.
• Use process data to measure the effectiveness of your business processes with process insights.

When selecting data to use in Process HQ, you'll need to make sure your users have access to everything they need to build comprehensive reports and gain insight into your business processes. You can apply multiple layers of security to take full advantage of Process HQ while also protecting sensitive data.

To manage access to your data in Process HQ:

• Review security on record types.
• Choose record types to use as datasets.
• Assign data stewards to record types.
• Secure process data.
• Grant access to processes.

Show record types as datasets

Your record types are not automatically available as datasets in Process HQ.

To enable report creators to build reports and dashboards with record data:

• Developers should review the record type security configurations to make sure report creators can access the data they need.
• A developer or data governor must make the record type available as a dataset.

Review security on record types

To allow users to view and update the record data in a report or dashboard, they need the following permissions on the base record type and any related record types:

Security	Required Configuration
Record type object security	Users must have at least Viewer permission to view the record type as a dataset and use the data in reports and dashboards. As a best practice, you should configure the record type security so that Default (All Other Users) is set to No Access. This ensures that only users who have been specifically granted permission to the record type are allowed to see the record data.
Record-level security	Users must have access to see the appropriate records (or rows of data in the dataset). If no record-level security is applied, then users with Viewer permission to the record type can see all rows in the dataset.
Field-level security	Users must have access to see the appropriate fields. If no field-level security is applied, then users with Viewer permission to the record type can see all fields in the dataset.
Record action security	Users must have access to see the appropriate record actions. Users must also have Initiator permission to the underlying process models.
Record view security	No additional configuration necessary. Users can only view a record's Summary view, which is automatically visible to any user with permission to see the record type and the record itself.

Choose record types to use as datasets

Developers and data governors can allow synced record types to be used as datasets. When a record type is available as a dataset, users with the appropriate permissions can:

• Ask AI Copilot about all available datasets in the Data Catalog.
• Use datasets to build reports and dashboards.

If report creators need access to data from one-to-one and many-to-one related record types, make sure those record types are also available as datasets. You should only allow users to access record types they need.

There are two ways to make a record type available as a dataset:

Who	Where	How
Developers	Record type in Appian Designer	In the record type, go to Workspaces. Select the Show this record type as a dataset in the Data Catalog of Process HQ checkbox. Click SAVE. Deploy the record type to production.
Data Governors	Data governance in Process HQ	In Process HQ, go to the Data Governance page. To show or hide a single record type from the Data Catalog, use the toggle in the Data Catalog column. To show or hide multiple record types from the Data Catalog, select the checkbox next to the record types and click SHOW IN DATA CATALOG. Any data governance configurations will take precedence over the record type configuration.

Use record types as process data

To use synced record types in a process and allow business users to analyze it:

• Data governors must assign data stewards to record types, so those data stewards can see that data in Process HQ and use it to add a process.
• Data stewards should hide sensitive data from the process as needed.
• Data stewards must set permissions for other users to access the process.

Grant access to processes

To grant other users access to processes, data stewards can configure security for processes they add.

Users can have either Viewer or Analyst permissions for processes.

Action	Analyst	Viewer
Add a process KPI to a dashboard *	Yes	Yes
Access a process, view, KPI, or insight	Yes	Yes
Add, edit, or delete a process view	Yes	No
Add, edit, or delete a KPI	Yes	No
Drill down to insights	Yes	No
Save an insight	Yes	No
Comment on a saved insight	Yes	Yes
Define the expected activity order or activity costs	Yes
View conformance and costs	Yes	Yes

^{* Must also be a member of the Data Fabric Report Creators system group}

Feedback