So can a process model that is in an unpublished application still run if a user

You can start a process for debugging if you have rights to edit that process, regardless if the application the process model belongs to is published or not. To do this, open the process model as process designer and go to File > Start Process for Debugging. See attached screenshot.

Yep I realized that. What I was referring to is an end user somehow accessed a process that is not published. We think it was through a bookmark. The action link in the main menu is not visible so they can't get to it through Appian menu. So since the application is not published and an action link to the process model is not visible can a user access a process model via bookmarked link ?

Beyond selecting the action in Tempo, the only other way I could see a user starting that process would be if the are 1) part of the Developers group, 2) a viewer of the application, and 3) an administrator of that process model and going into the process model to start it for debugging. I couldn't navigate directly to the process modeler in a separate tab in IE that may have been bookmarked, so I don't think they were able to get into it through there. Is it possible to ask your end user how they triggered that process?