From
<https://docs.microsoft.com/en-us/windows/win32/fileio/file-security-and-access-rights>:

"Because files are securable objects, access to them is regulated by the
access-control model that governs access to all other securable objects
in Windows. For a detailed explanation of this model, see Access Control."

"You can specify a security descriptor for a file or directory when you
call the CreateFile, CreateDirectory, or CreateDirectoryEx function. If
you specify NULL for the lpSecurityAttributes parameter, the file or
directory gets a default security descriptor. The access control lists
(ACL) in the default security descriptor for a file or directory are
inherited from its parent directory. Note that a default security
descriptor is assigned only when a file or directory is newly created,
and not when it is renamed or moved."