Creating Custom Study Roles

For your convenience, several standard Study Roles are available by default. You can see a list of those standard roles here. You can assign these standard roles to users in your study, or you can assign your users custom roles. You can copy the standard Study Roles to use as a template when creating your custom roles as well.

Creating a Custom Role

You can create Study Roles from scratch or by copying an existing Study Role. If you create a new Study Role from scratch, there are additional configuration steps you must perform for your new role to become functional.

New Study Role

To create a new Study Role from scratch:

Create the Role

To create a new role:

1. Navigate to Tools > System Tools > Role Management.

2. Click + New Role.

3. Enter a Name for your new role. Note that this Name must be unique at the vault level.

4. Optional: Select a Team for your new role. This is the team this role works on queries within.
5. If you are creating a custom role from scratch, don’t select a role in Copy from Role.

6. Click Save.

7. Select the permissions that you want to assign this role in the Standard Tabs, Permissions, User Defined Objects, and, if multi-role security is enabled, User Defined Permissions sections. Selecting the permission assigns the permission. If you don’t select a permission, this role will not have that permission.

8. Click Save.

Vault creates a custom Security Profile and Permission Set with the appropriate permissions and maps it to your new Study Role. If your vault is using multi-role security, Vault only creates Permission Set. If you want to assign permissions for custom objects and tabs, you can perform that configuration now. See details here.

Copy from Existing Role

To create a new Study Role by copying an existing or standard Study Role:

1. Navigate to Tools > Role Management.

2. Click + New Role.

3. Enter a Name for your new role. Note that this Name must be unique at the vault level.

4. Select a standard Study Role in Copy from Role. Vault copies this Study Role into your custom Study Role.

5. Click Save.
6. Select the permissions that you want to assign this role in the Standard Tabs, Permissions, User Defined Objects, and, if multi-role security is enabled, User Defined Permissions sections. Selecting the permission assigns the permission. If you don’t select a permission, this role will not have that permission.
7. Click Save.

Vault creates a custom Security Profile and Permission Set with the appropriate permissions and maps it to your new Study Role. If you want to assign permissions for custom objects and tabs, you can perform that configuration now. See details here.

Editing Custom Roles

You can edit custom Study Roles from Tools > Role Management as needed.

Once a role has been edited, you can publish the updated role to other connected vaults by ensuring that the role has been selected in the User Defined Roles deployment list and deploying the role to the target vault. When you edit a custom Study Role, Vault immediately applies those changes to every user with that role assigned.

To edit a custom Study Role:

1. Navigate to Tools > System Tools > Role Management.

2. From your custom role’s Actions menu, select Edit.

3. Select and deselect permissions as needed.
4. Click Save.

Rename a Role

You can rename custom Study Roles that are not currently assigned to any users in the vault.

Once a role has been renamed, you can publish the updated role to other connected vaults by ensuring that the role has been selected in the User Defined Roles deployment list and deploying the role to the target vault.

As is the case in the source vault, for the role to be renamed in the target vault, there must not be any users in the target vault that are assigned that role.

To rename a custom Study Role:

1. Navigate to Tools > System Tools > Role Management.

2. From your custom role’s Actions menu, select Rename.

3. In the Rename Role dialog, enter a new Name.

4. Click Save.

Change Teams

To change the Team assigned to a role:

1. Navigate to Tools > System Tools > Role Management.

2. From your custom role’s Actions menu, select Rename.

3. In the Rename Role dialog, select a new Team.

4. Click Save.

Deleting a Role

In some cases, if your organization is no longer using a custom Study Role and no users are currently assigned that role, you can delete it. For vaults created after the 21R2 release, which have the multi-role security feature, custom roles cannot be deleted if they have been deployed. For vaults created before the 21R2 release, which do not have the multi-role security feature, custom roles can be deleted in DEV vaults but the deletion does not take effect in other vaults.

To delete a custom Study Role:

1. Navigate to Tools > System Tools > Role Management.

2. From the custom role’s Actions menu, select Delete.

3. In the Delete Role confirmation dialog, click Delete. Vault deletes your custom Study Role.

Teams

Vault CDMS includes Teams. If your Study uses the Team Query Restrictions feature, these teams control the ability to close queries created within a team. If a query is created by one team, for example, the Clinical team, then only members of that team can close the query. In this example, a member of the Data Management team would be able to comment on the query, but that user wouldn’t be able to close it.

You assign custom roles to a team during role creation or by renaming the role. Note that a role may only belong to one team.

Team	Standard Roles
Administration	CDMS Deployment Administrator CDMS User Administrator CDMS Randomization Manager CDMS Safety Administrator CDMS Super User
Clinical	CDMS Clinical Research Associate
Coding	CDMS Clinical Coder CDMS Clinical Coder Administrator CDMS Clinical Coder Manager
Data Management	CDMS Data Manager CDMS Lead Data Manager CDMS Medical Assessment Editor CDMS Medical Assessment Reader CDMS Labs Data Manager CDMS Data Loader
Other	CDMS Study Designer CDMS Study Designer Read Only CDMS Librarian CDMS Auditor Read Only CDMS API Read Only CDMS API Read Write CDB API Read Write
Site	CDMS Principal Investigator CDMS Sub Investigator CDMS Clinical Research Coordinator

Available Permissions

The functional permissions listed in Role Management represent a combination of Application Role and Security Profile based permissions. In Tools > Role Management, each row represents either a functional permission or the ability to access a standard tab (such as Data Entry or Coder) in Vault CDMS. A selected (checked) permission indicates that a role has this permission.

Refer to this table for information about permissions and what standard Study Roles have these assigned.

Which permissions display in the User Defined Objects and User Defined Permission Sets sections depend on your vault’s configuration.

The tables below list each functional permission and a description of what it controls.

Standard Tabs

You can control access to the following standard tabs from the Standard Tabs section of the role table:

Permissions

After standard tabs, permissions are grouped into functional areas. You can collapse and expand these sections.

Dependent Permissions

Some permissions are dependent on or included with other permissions. If you have access to a controlling permission, you automatically have access to the dependent permissions listed. You can’t remove a dependent permission without removing the controlling permission. Refer to the table below for a comprehensive list of controlling and dependent permissions.

When a permission is dependent and disabled, you can hover over its checkbox to view the controlling permission.

Permission Sets to Handle User Defined Objects & Tabs 21R2 & Later

If your organization is using Multi-Role Security, you can use a User Defined Permission Set to control access to user defined objects and tabs. This creates a single permission row in the Role Management table, where you can assign all permission granted in the set to a custom Study Role.

Create a User Defined Permission Set

To create a new User Defined Permission Set:

1. Navigate to Tools > System Tools > User Defined Permission Sets.

2. Click New Permission Set.

3. Enter a Name for the Permission Set.

4. Click Save.
5. Click the Name of your new Permission Set to open it.
6. Click Manage Tabs.
7. In the Manage Tabs dialog, use the shuttle menu to move the needed tabs from Available Tabs to Selected Tabs.
8. Optional: To remove a Tab:
   1. Hover over the Tab row to show the Remove () button.
   2. Click Remove ().
   3. In the Remove Tab confirmation dialog, click Remove.

9. Click Objects.

10. Click Manage Objects.
11. In the Manage Objects dialog, use the shuttle menu to move the needed objects from Available Objects to Selected Objects.
12. Click Edit Objects.
13. Select the checkboxes for Create, Read, Update, and Delete to assign those permissions.
14. Click the Binoculars () to view a list of object fields.
15. Select the Object Field Permissions checkbox to set Read and Update permissions at the field level:
    1. In the Object Field Permissions dialog, click Edit.
    2. Select the Read and Update checkboxes on each field that you want to give the permission to read or update.
    3. When finished, click Save.
    4. After you’ve assigned field permissions, Vault displays a checkmark in the Object Field Permissions column. Click the Checkmark () to view field permissions.

Once you finish assigning tab and object permissions to a User Defined Permission Set, you can assign it to Study Roles in the User Defined Permission Sets section of the Role Management table.

Edit the Assigned Permissions

To edit the permissions assigned to a User Defined Permission Set, follow steps 5-15 of the [Create a User Defined Permission Set](#create-a-user-defined-permission-set] instructions above.

Sync a User Defined Permission Set

If you make changes to a User Defined Permission Set that is already assigned to a Study Role, you must use the Sync action to update the User Defined Permission Set on the Study Roles.

To sync a single permission set:

1. Navigate to Tools > System Tools > User Defined Permission Sets.
2. Locate the User Defined Permission Set you want to sync in the list.
3. Hover over its Name to show the Actions menu.
4. From the Actions menu, select Sync.
5. In the Sync confirmation dialog, click Sync.

To sync multiple permission sets in one action:

1. Navigate to Tools > System Tools > User Defined Permission Sets.
2. Select the User Defined Permission Sets you want to sync in the list.

3. Click Sync.

4. In the Sync confirmation dialog, click Sync.

Rename a User Defined Permission Set

To rename a User Defined Permission Set:

1. Navigate to Tools > System Tools > User Defined Permission Sets.
2. Locate the User Defined Permission Set you want to edit in the list.
3. Hover over its Name to show the Actions menu.

4. From the Actions menu, select Edit.

5. In the Edit Permission Set dialog, enter a new Name.
6. Click Save.

Delete a User Defined Permission Set

You can delete a User Defined Permission Set as long as it isn’t assigned to any Study Roles.

To delete a User Defined Permission Set:

1. Navigate to Tools > System Tools > User Defined Permission Sets.
2. Locate the User Defined Permission Set you want to delete in the list.
3. Hover over its Name to show the Actions menu.

4. From the Actions menu, select Delete.

5. In the Delete Permission Set confirmation dialog, click Delete.

User Defined Object Permissions

Role Management supports setting Read, Edit, and Delete permission on user-defined (custom) Vault objects for custom Study Roles. (Note that Create permission must be provided as part of a Security Profile.)

To manage access to a user-defined object through Role Management, the object must meet all of these conditions:

• The object must be a custom object “__c” namespace.
• The object must have an object reference field to the Study (study__v) object.
• The object must have a Deployment List record.
• The object must have an object lifecycle.
• The object must have Matching Sharing Rules enabled.

If your object meets these four conditions, Vault automatically includes it in the permissions table, in the User Defined Objects section.

Each object includes three rows for the Read, Edit, and Delete permissions. When you create or edit a custom Study Role, you can select these permissions in the same way as standard permissions. Note that these permissions are dependent. If you assign Edit, Vault automatically assigns Read. If you assign Delete, Vault automatically assigns Read and Edit.

Providing a user with one of these permissions on an object does not provide them access to view the custom tab exposing that object. You must provide that access via the role’s Security Profile or, for multi-role security vaults, with a User Defined Permission Set.

Use Cases Requiring Configuration with Role by Study 21R1 & Earlier

The sections below detail use cases that require additional configuration by a Vault Owner to work with the Role by Study security model. These configurations aren’t required for organizations using Multi-Role Security (introduced in 21R2, August 2021). Contact your Veeva Services representative to discuss enabling Multi-Role Security in your vault.

Multiple Roles in a Vault

If a user in your Vault has multiple Study Roles assigned in different Studies, you may need to create a custom Security Profile and map it to the custom Study Role to ensure that they have the permissions they need.

For example, if Amir is a lead data manager for the Deetoza study, but he also acts as an auditor for the Veeofen study, he will need a custom security profile to ensure that he has the appropriate access in both Studies.

When you create a custom Study Role, Vault automatically creates a Permission Set that contains all of the access and permissions specified in Tools > Role Management. You can assign the Permission Set from each role to the custom Security Profile for this user.

1. From Admin > Users & Groups > Security Profiles, create a new Security Profile and assign the Permission Sets for both custom roles to the Security Profile.
2. From Admin > Users & Groups > Users, assign the new custom Security Profile to your user.
3. From Tools > EDC Tools, add the user to both Studies, assigning the chosen custom Study Roles.

Study Roles for Custom Tabs

If you create custom tabs in your vault, you must perform additional security configuration to manage access using Study Roles.

• Create a Permission Set (or more than one) that assigns access to those objects and tabs.
• Either add that Permission Set to the existing Security Profile for your custom role (this profile has the same name as your custom Study Role) or create a Security Profile that has that Permission Set assigned, as well as any other Permission Set that a user would require to use Vault with that profile.
• If you created a custom Security Profile update the Application Role Security Profile Rel mapping record for your custom Study Role to reference the custom Security Profile.

Mapping a Security Profile to a Custom Study Role

Vault uses the Application Role Security Profile Rel object to connect Study Roles (Application Roles) and Security Profiles. If you created a custom Security Profile for a Study Role to provide access to custom configurations, instead of updating the existing Security Profile for your Study Role, you must map the new Security Profile to the Study Role by updating the Application Role Security Profile Rels record for your role.

To update an Application Role Security Profile Rel record:

1. Navigate to Admin > Business Admin > Security Profiles.
2. Locate your custom Security Profile in the object record list.
3. Copy or make a note of the Profile Name field value.
4. Navigate to Admin > Business Admin > Application Role Security Profile Rels.
5. Locate the record for your custom Study Role in the object record list.
6. Click to open that record.
7. Click Edit.
8. In the Security Profile field, remove the existing value.
9. Paste or enter the copied Profile Name into the Security Profile field.
10. Click Save.