QualityOne Vaults allow you to define application security to automatically grant users specific access based on their Application Role for a particular secured object. Secured objects are Raw object data stores, which supports the growing volume of object records while maintaining Vault performance. You must define record-level security for the secured object as this data store option cannot be defined by DAC. To do so, you must first define users, user groups, organizations or facilities, and application roles to determine the level of access an internal or external user has for the following secured object:
- Inspection Sample Test Result: Select Inspection Sample Test Result in the Secured Object field on Object Sharing Rule, Role Matching Criteria, and Record Matching Rule records to configure Application Security for the Inspection Sample Test Result object.
About the Application Security Process
After you define the applicable User, User Group, Organization or Facility, and Application Role records, Vault does the following when an active User is detected:
- If the User has applicable DAC sharing rules configured for the secured object, the User gains access to the secured object records allowed by these sharing rules.
- Vault checks all Object Sharing Rule records for the secured object and the User. If the User belongs to an existing User Group, Vault assigns the appropriate Application Roles to the User for the secured object.
- Vault checks all Record Matching Rule records for the User and all the Role Matching Criteria records for the secured object. If the User has existing Record Matching Rule records with defined Application Roles and Facility or Organization configuration, Vault matches the Record Matching Rule records to the Role Matching Criteria record defined for the same Application Roles and Facility or Organization configuration for the secured object. Vault uses this match to assign the appropriate Application Roles to the User for the secured object. If there are no matches, Vault does not match based on the defined Record Matching Rule record.
- If the User has no Application Roles assigned and no applicable sharing rules for the secured object, Vault does not allow the User to gain access to the secured object and its records.
Overview
For users to view or interact with a secured object for the applicable lifecycle, create the appropriate records for the following:
Object Sharing Rule Component
This component contains the sharing rules for user groups. In this component, Admins configure the Application Role that Vault assigns to all users belonging to a User Group for a Secured Object. Navigate to Admin > Configuration > Application Security Setup > Object Sharing Rules. Create an Object Sharing Rule by adding an Application Role to assign to all users belonging to a User Group for a secured object.
You can use any application role available in the secured object’s lifecycle. If an existing Object Sharing Rule record exists, you cannot create duplicate records with the same combination of Application Role, Secured Object, and User Group field values. Depending on configuration, you may create up to ten (10) Object Sharing Rule records for each secured object. For additional help on this configuration, contact your Veeva Representative for more details.
Role Matching Criteria Component
This component defines the access criteria for the applicable Application Role. Navigate to Admin > Configuration > Application Security Setup > Role Matching Criteria. Create a Role Matching Criteria by assigning the matching field of an object to an Application Role.
Depending on your use case, you can enter a field name value into the Record Matching Field and Secured Object Field fields on Role Matching Criteria records that references either the Organization or Facility object. These must be fields on the Inspection Sample Test Result object. To reference the Facility object field, use the following field:
facility__v
To reference the Organization object field, use one (1) of the following fields:
supplier_name__vsupplier_manufacturing_site_name__v
Field values entered into the Record Matching Rule Field on Role Matching Criteria records must be in the following format: Field.[matching_field_name__v]. For example, for the Facility field, enter Field.facility__v into the Record Matching Field and Secured Object Field fields.
If an existing Role Matching Criteria record exists, you cannot create duplicate records with the same combination of Application Role, Record Matching Rule Object, Record Matching Rule Field, Secured Object, and Secured Object Field field values. Depending on configuration, you may create up to ten (10) Role Matching Criteria records for each secured object. For additional help on this configuration, contact your Veeva Representative for more details.
Record Matching Rule Object
This object contains the sharing rules for individual users belonging to either an organization or facility. In this object, Admins configure the Application Role that Vault assigns to an individual user for a secured object. Navigate to Business Admin > Objects > Record Matching Rule. Create a Record Matching Rule by adding an Application Role to assign to a User belonging to either an external Organization or an internal Facility.
Users can belong to up to 15 Facilities, and users at a Facility can have more than one (1) Application Role. For additional help on this configuration, contact your Veeva Representative for more details. You can use any application role available in the secured object’s lifecycle. Record Matching Rule records are also automatically created when External Collaborators are added or activated and deleted when inactivated through External Collaboration Management object actions. Record Matching Rules are subject to the Role Matching Criteria.