Overview:
Roles are being defaulted to documents during creation.
Root Cause:
Default or Override rules configured for a Role.
Solution:
Users can be automatically added to Vault Documents even after they are removed from the Document Types Security configuration. This can happen due to Default Rule or Override Rules setup on a specific User Role.
This information can be viewed by:
- Navigating to: Admin --> Configuration --> Document Lifecycles.
- Select the Lifecycle that corresponds with the Document Role.
- Click on Roles.
- Choose the Role that is defaulting on the document.
Look for checkboxes for Add Default Users When:
- Starting a workflow
- Creating a document
These configurations set Users and Groups into the Role during document creation or the start of a workflow. Looking at the two tabs for Default Rule and Override Rules identifies who is set to be added into this Role and when.

Related Documentation:
Vault Help Documentation: Defining Allowed & Default Users for Roles
Thank you