QualityOne Vaults allow users to efficiently manage temporary, short-term access to your Vault for external collaborators by eliminating manual Vault account creation, activation, and inactivation. Setting up external collaborators with temporary access allows external users to respond to your organization’s collaboration requests using an external license from the same pool of external licenses. You can give users the ability to request responses from recognized external contacts, collaborate with those individuals in Vault, and finish with minimal to no need of managing user account provisioning for those external collaborators.

When users request collaboration from external contacts for supplier-related records, Vault automates the provisioning of External Collaborator accounts for those contacts and invites them to collaborate by sending specialized email notifications. A collaboration is completed when external contacts respond to all requests assigned to them. When collaboration is complete, Vault automatically inactivates external user accounts, freeing up external licenses for other new external contacts with collaboration requests to utilize for activation.

External Collaboration Management Objects

QualityOne uses the following objects and object types to support External Collaboration Management:

  • Person (person__v): This object represents named individuals used as data references. Being a Person in Vault does not necessarily grant login access nor does it give the ability to participate in workflows.
  • Organization (organization__v): This object represents information relating to individual organizations.
  • Recording Matching Rule (recording_matching_rule__v): This object represents sharing rules for individual users with a particular application role for the secured object.

Target Objects

These objects and object types can be used as a target object for configuration. Target objects are configured to display the relevant fields on the object records needed for users to assign external contacts.

  • CAR (car__v): This object represents corrective action requests.
    • SCAR (scar__v): This CAR object type represents supplier corrective action requests.
  • NCR (ncr__v): This object represents nonconformances.
    • Supplier NCR (supplier_ncr__v): This NCR object type represents supplier nonconformances.
  • Audit (audit__qdm): This object represents audits.
    • Supplier Audit (supplier_audit__qdm): This Audit object type represents supplier audits.
  • Change Control (change_control__v): This object represents change requests.
    • Supplier Change (supplier_change__v): This Change Control object type represents supplier change requests.
  • Inspection (inspection__v): This object represents inspections.
    • COA Inspection (coa_inspection__v): This Inspection object type represents data about COA inspections.

Configuration Overview

Configuring your Vault to use External Collaboration Management involves the following steps:

  1. Set up a Security Profile for use with external collaborators
  2. Define an External Collaborator User Template for External Collaborators
  3. Configure Object Notification Templates
  4. Configure the Person, Organization, and target objects
  5. Configure the target object lifecycle
  6. Configure the target object actions
  7. Optionally, configure the relevant target object workflows

Setting Up User Security Profile

When Vault automatically creates Users, Vault determines a specific Security Profile to use for the external collaborator via an External Collaborator User Template. Ensure you set up an appropriate Security Profile to use for the External Collaborator User Template. Setting up an appropriate Security Profile tailors the experience for the external user within your Vault to be as robust or simplified as necessary. We recommend “External Collaborator” as the label for the new Security Profile.

Defining External Collaborator User Templates

You can configure your Vault to automate the creation and activation of External Collaborators. See Defining External Collaborator User Templates for more details.

Configuring Object Notification Templates

There are three (3) email notification templates for each target object you can configure to which Vault automatically sends to third-party contacts based on the way the external user is collaborating with your organization. When Vault automatically creates a User account, Vault sends a Welcome email to that third-party contact. When an external collaborator is activated again to collaborate, Vault reactivates the User account and sends a Welcome Back email to that third-party contact.

Vault sends a Goodbye email to third-party contacts when their work is complete. Depending on your configuration, an external collaborator’s work may be complete at various lifecycle states on a given request. Vault sends the Goodbye email when the external collaborator’s response is accepted, and no more requests are waiting for the collaborator’s response in the Vault.

Notification Templates

The relevant notification templates are:

  • External Collaboration Welcome - [target_object_label] (ext_collab_welcome_[target_object_name]__v)
  • External Collaboration Welcome Back - [target_object_label] (ext_collab_welcome_back_[target_object_name]__v)
  • External Collaboration Goodbye - [target_object_label] (ext_collab_goodbye_[target_object_name]__v)

You can update the notification templates to include information about the request, the request’s parent object record (for example, SCAR), and if configured, the parent object record’s Team members from your organization. Configuring the notification templates ensures that the recipient knows what actions are required from them and any additional collaborative information with your organization.

External Collaboration Notification Template Tokens

QualityOne Vaults can use additional token support using standard object notification configurations. Tokens are pieces of text that are replaced at the time the notification template is used. You can use the following tokens within the email content for document notification templates:

  • firstName: The recipient’s first name.
  • lastName: The recipient’s last name.
  • authServiceExtUrl: The authorized URL to login page.
  • staticContentBaseUrl: This displays images.
  • userName: The user’s username.
  • userEmail: The user’s email address.
  • vaultName: The name of the internal user’s Vault.
  • userLanguage: This displays the recipient’s language. This is part of the one-time password reset link.
  • userPassword: This displays the recipient’s automated password.
  • utp?url: This is part of the one-time password reset link.

You can also include the special ${creator} and $($creatorEmail) tokens in these notification templates. Use of these special tokens in the object notification template allows you to add the name and email of the object record creator.

Configuring External Collaborator Objects

Configure the Person, Organization, and applicable target objects needed to configure automated Vault account creation, activation, and inactivation.

Configuring the Person Object

On the Person object, activate the Organization object reference field and add it to the Person object layout.

Configuring the Organization Object

We recommend you configure the Organization object to simplify the management of a contact list of Persons. Person records have a field linking them to Organizations, and Organization records can list the Persons that your organization interacts with. This allows for easier identification of contacts listed in the External Collaborator field that users can choose from to assign records to collaborate on, such as SCARs. You can manage these contacts centrally or you can enable requestors or other internal users to manage these persons independently for the Organizations they work with.

To configure the Organization object to display contact lists, insert a Related Object section with the Person object into the layout of the Organization object. We recommend defining Section Help for this contact list so that its purpose is clear to users.

Configuring the Target Object

When deploying External Collaboration for a target object, you must make several modifications to the target object (for example, the CAR object for SCAR) configuration to set up the external collaboration.

Enabling Custom Sharing Rules

You must enable the Custom Sharing Rules for the Dynamic Access Control option on the target object to activate External Collaboration Management.

Configuring External Collaborator Field

On the target object, activate the External Collaborator field. We recommend you use the Constrain Records in Referenced Object field option to limit the selection of the External Collaborator to only persons within a related Organization. To do this, you can add the following VQL statement:

organization__v = {{this.supplier__v}}

This statement limits selection of External Collaborators to the Organization referenced in the Supplier field of the target object. We recommend this configuration to ensure users choose appropriate collaborators for each request.

You can add the External Collaborator field to the applicable target object type (for example, SCAR) and its corresponding layout. When configuring a constraining statement, the constraining field should be listed before the External Collaborator field so that the constraints take effect prior to choosing an External Collaborator.

Configuring Supplier Field

Optionally, you can establish a default value for the organization the request is against, based on the associated parent process’ object. To do so, add the default organization value to the target object record’s Supplier field.

Configuring the Target Object Lifecycle

To configure your target object’s lifecycle, you must first determine which lifecycle state of the target object you want to bring an external collaborator into your Vault (entry state) and the state in which their User account should be removed from your Vault (exit state). The “entry” state should be the state that you want external collaborators to start giving responses and the “exit” state should be the state that you want external collaborators to stop responding, after accepting their responses. After determining your “entry” and “exit” states, configure your target object’s lifecycle by adding the application role and your object actions for your two (2) states.

External Collaborator Application Role

Add the External Collaborator application role to the target object’s lifecycle. As this is the role that external collaborators will be added to or removed from using the configuration from External Collaborator User Templates, ensure that the role has appropriate permissions for each lifecycle state utilized with the target object’s object type.

Configuring the Target Object Actions

The target object’s lifecycle contains Create & Activate External Collaborator and Inactivate External Collaborator actions to configure for your “entry” and “exit” lifecycle states. You can also mirror the same effect that the Inactivate External Collaborator action triggers by manually removing assignments from the External Collaborator field or deleting a target record with an active assignment.

Depending on your business needs, you can:

Configuring the Create & Activate External Collaborator Entry Action

Add the Create & Activate External Collaborator entry action to an “entry” lifecycle state. You must select an External Collaborator User Template for Vault to use during automated User account creation. This entry action attempts to activate a user account for the Person record referenced in the External Collaborator field.

If Vault determines that a User account already exists with the exact details as the Person, Vault actions the following:

  • Assigns that user account to the Person.
  • Activates that User account.
  • Sends the named External Collaborator a Welcome Back notification.

If Vault determines that there is no existing User account, Vault actions the following:

  • Creates a new User account.
  • Activates the User account.
  • Sends the named External Collaborator a Welcome notification.

User records created by this action have their Managed by QMS Automation field set to True. Setting this field to False manually stops the access management automation for the user: access is managed manually by you.

Configuring the Inactivate External Collaborator Entry Action

Add the Inactivate External Collaborator entry action to an “exit” lifecycle state. This entry action allows Vault to find the Person in the External Collaborator field, identify the User account associated with the Person, and to check if the User account can be inactivated. Vault checks for any requests assigned to the User account that was granted by the Create & Activate External Collaborator actions and have not yet had the Inactivate External Collaborator entry action triggered.

If Vault determines that the User account has completed all requests assigned for an external response, Vault actions the following:

  • Inactivates the User account.
  • Sends the named External Collaborator a Goodbye notification.

Vault does not remove inactivated users from Sharing Settings on individual records by default. To limit external collaborators’ access to certain records in the event that their User account is reactivated, you must add an Update Sharing Settings step in your target object’s workflow. Optionally, removing or changing the External Collaborator value on the target object’s record removes the User from Sharing Settings.

Configuring the Create & Activate External Collaborator User Action

Add the Create & Activate External Collaborator user action to lifecycle states that users may need to replace an inactivated external collaborator, such as when an external user is removed from a target object’s External Collaborator field. We recommend you restrict access to this action using Atomic Security.

Optionally, you can also choose to prevent changes to the External Collaborator field in an “exit” lifecycle state using field-level Atomic Security, or use workflow steps or lifecycle action configurations to move the target object into a “pre-response” state to “restart” the collaboration process again.

Removing Assignments from the External Collaborator Field

Whenever a Person assignment in the External Collaborator field of a target object’s record is removed or changed, Vault evaluates if the Person’s associated User account should be inactivated following the same actions taken in the Inactivate External Collaborator entry action, with the following added action: the Person’s associated User account is removed from the External Collaborator application role.

Configuring the Target Object Workflow

Collaboration with external users may result in cases where an internal user needs to respond on behalf of the external collaborator, or abandon a collaboration on a specific request or any requests with specific partners. Ensure you account for the internal users’ ability to take over assignments or bypass collaboration when necessary when configuring your target object’s lifecycles and workflows.

About Assignment Tracking

External Collaboration Management tracks and stores data when Vault activates or inactivates a User for a Person referenced on an External Collaborator field. Every time a User is active, Vault creates a new record that references the matching target object’s record and sets the new record’s Assignment Activity field as “Active”; for example, the CAR target object’s matching External Collaborator CAR Assignment object.

Every time a User is inactive, Vault updates the relevant existing object record’s Assignment Activity field to “Inactive”. Tracking the assignments of a Person via the Managed by QMS Automation field allows Vault to verify whether an External Collaborator has any outstanding tasks left before automatically inactivating the User account of the Person. If the Managed by QMS Automation field is set to “False” on the User record, Vault stops automatically tracking and managing assignments.

You can complete all the steps in this article with the standard System Administrator or Vault Owner security profile. If your Vault uses custom security profiles, your profile must grant the following permissions:

Type Permission Controls
Security Profile Admin: Configuration: Object Lifecycles: Edit Ability to modify object lifecycles.
Security Profile Admin: Configuration: Object Workflows: Edit Ability to modify object workflows.
Security Profile Admin: Configuration: Objects: Create, Edit Ability to create and modify Vault objects.
Security Profile Admin: Security: Permission Sets: Create, Edit, Delete Ability to make changes to permission sets for users.
Security Profile Objects: Audit (all object types): Create, Edit, Delete Ability to make changes to Audit, Supplier Audit.
Security Profile Objects: CAR (all object types): Create, Edit, Delete Ability to make changes to CAR, SCAR.
Security Profile Objects: Change Control (all object types): Create, Edit, Delete Ability to make changes to Change Control, Supplier Change.
Security Profile Objects: Inspection (all object types): Create, Edit, Delete Ability to make changes to Inspection, COA Inspection.
Security Profile Objects: NCR (all object types): Create, Edit, Delete Ability to make changes to NCR, Supplier NCR.