About Permission Sets

In Vault, permission sets are a way to group permissions together. Security profiles then use the permission sets to grant or restrict users’ access to certain features, particularly system administration functions such as user management or object record creation. For example, the permission sets applied to the IT Administrator security profile allow users with that profile to manage users and groups, but not studies and sites.

Accessing Permission Set Configuration

To configure permission sets, you must have the Admin: Permission Sets: Read, Create, Edit, Delete permissions.

With the right access, you can manage permission sets from Admin* > Users & Groups > Permission Sets.

About ‘All’ Permissions

Throughout the permission sets configuration, there are permissions like All Configuration and All Audit. Granting these permissions gives users all permissions under them. However, this functions differently from simply selecting each sub-permission. If a future release of Vault adds new permissions to an area, permission sets with the ‘All’ permission will automatically select those new permissions.

About Permission Dependencies

Granting certain permissions automatically grants additional permissions. When editing, these dependent permissions will be greyed out as long as their controlling permission is selected.

For example, when you grant the Web Actions: Delete permission, you automatically grant the Web Actions: Edit permission.

Admin Permissions

Access to administrator-type functionality is controlled by permissions assigned via permission sets and security profiles. The sections below align with the headings in the Admin tab of the Permission Sets page.

Note that in addition to license type, security profile, and permission set, some access is controlled by the Domain Admin user setting.

Configuration

Domain Administration

Security

Settings

Deployment

Application Permissions

Access to certain Vault-area functionality is controlled by permissions assigned via permission sets and security profiles. The sections below align with the headings in Application tab of the Permission Sets page.

There are three layers of security applied to actions. First, you must have a license type that allows the action. For example, the Read-Only User license type does not allow access to reports. Second, you must have a permission set that grants the correct permission. For example, you would need the Read Dashboards and Reports permission to see any dashboard. Third, for document actions, you must have the correct document role-based permissions. For example, even with a permission set that grants the Bulk Update permission, you would also need the Edit Fields permission on any documents that you’re attempting to update in order to perform a bulk document field edit.

Vault Actions

Object Permissions

From the Objects tab, you can assign permission to view, create, edit, and delete object records at the object level. For example, a user could have full permissions to Study Site object records, Edit permission to Study records, Read access to Product records, and no access to Country records. From this tab, you can also set up field-level security on objects.

For each object, you can grant or remove the following permissions:

• Read: Allows you to view records for the object; see details
• Create: Allows you to create new object record or to copy an existing record; allows you to access Admin > Business Admin. With this permission, Vault automatically grants Edit permission.
• Edit: Allows you to edit an existing object record, including adding/deleting/versioning attachments; allows you to access Admin > Business Admin
• Delete: Allows you to delete an existing object record

Granting these permissions for All Objects means that the permission set will automatically include the permissions for any object created in the future.

Dynamic Access Control

Note that Dynamic Access Control interacts with these settings to prevent users from viewing, editing, or deleting specific object records. If an object uses DAC, users must have both the appropriate permission through their security profile and access through the individual object record’s sharing settings. When creating a record, Vault only considers the user’s permission sets.

Tab Permissions

From the Tabs section, you can control what tabs a user can view. All standard and custom tabs can be configured here. If a user has the View permission on All Tabs, they can view newly created tabs by default.

About the Read Permission

Users must have the Read permission on an object to:

• View a custom object tab
• View an object tab in Business Admin
• See object record details in a hover card
• Select an object record when editing object fields
• Create a report using a report type that includes the object
• View results for a report using a report type that includes the object

Users without this permission can still view object record labels throughout Vault. For example, they can still search for documents using object fields for an object they cannot view.

EDC Permissions

EDC application vaults display a fifth section, EDC. This section lists permissions specific to the EDC application. For details, see About EDC Security Profiles.

Hidden or Missing Permissions

When you open a permission set, some of the permissions listed above will not appear. If a permission does not appear:

• The permission is specific to another Vault application or another application family. For example, the permission is specific to RIM and you are in a Clinical vault.
• The permission is related to a feature that is not enabled on your vault. Sometimes, permissions are hidden when the related feature is not enabled.