Admins can create and configure Quality Teams and Quality Team Roles to suit their needs. For example, a Change Control might require three team roles to work through from start to finish: a “Change Owner”, a “Lead QA Engineer” and “Subject Matter Experts”. Using Quality Teams allows you to dictate that every created Change Control requires exactly one “Change Owner”, exactly one “Lead QA Engineer” and between zero and five “Subject Matter Experts” in order to begin work.
Quality Teams allow users to make individual work assignments to individual Change Controls, Audits, CAPAs, or other Quality Event-related processes. Users define these assignments directly from the record detail page by selecting individual user assignments from a list of users authorized to perform that role on that record. Quality Teams integrates with object record sharing settings, allowing for a simple experience without sacrificing critical compliance tools.
How Quality Teams Work
You can create a Quality Team for any non-system object, with some limitations, that does not already have a Quality Team configured. In objects which have object types, you can configure a Quality Team for either:
- A single object type; or
- All object types which do not have a specific Quality Team definition
When defining Quality Teams, you can configure options such as lifecycle state changes that can trigger automated events. You can also lock the membership of all team roles in selected lifecycle states. For example, you might define a procedure dictating that all Change Controls are created in a “Pending Team Assignment” state that has no associated workflows. You can then configure Vault to automatically move the Change Control into the Initiated state of its lifecycle once the “Change Owner” and “Lead QA” have both been selected. The team completion can even start a workflow, assigning tasks to the team members defined.
Creating Quality Teams
How to Create a Quality Team Definition
- Navigate to Admin > Configuration > Quality Teams.
- Click Create.
- Enter a Label and Name.
- Select a Status. If you set a team to Inactive, Vault retains the team and role configuration, but the team won’t appear on associated object records. If you reactivate the team later, or create a new team for the same object and role, Vault preserves any team member assignments. This option can be helpful during initial configuration or in the event that you no longer want to use this team.
- Select an Object that this Quality Team applies to. If the object has types, you can select an Object Type. Once you create a Quality Team, you cannot change this option. You can have only one Quality Team active per object or type (if the object is typed).
- Optional: Select the Change record state when team is complete checkbox. See details.
- Optional: Select one or more Locked States. See details.
- Click Save. Vault takes you to the newly-created Quality Team definition page.
Once you create the Quality Team, Vault updates the relevant object page layouts with a Quality Team Members section. This page layout section shows team assignments and allows authorized users to select users for roles. We recommend editing your object page layout to make this section the first or second section on the page.
If associated object records exist before you configure a team and team roles, they will have Quality Team sections without assigned members after you configure the team.
Note that you cannot edit the Quality Team definition while creating or reordering Quality Team Roles.
Change Record State when Team is Complete
Select this checkbox, a Start State, and a Destination State to move an object record to a new state upon completion of the minimum Quality Team membership. This state change will also trigger any associated automated events, such as auto-starting workflows. Vault completes this event for an object record when:
- The team has at least one team role which with a Minimum Required Users of at least one (1);
- All roles which have the Minimum Required Users defined have that number of assignments; and
- A user updates the team members and the record is in the defined Start State
When the associated object record is in one of these specified locked lifecycle states, no user in the Vault may make changes to the membership of this Quality Team, including Vault Owners. Additionally, team-enabled records in locked states will not raise alerts for invalid or incomplete team assignments. This option is intended for end-of-life states of records’ lifecycles, where assignment information must be retained.
How to Delete Quality Teams
You cannot delete a Quality Team definition if any record which uses that team has any team member assignments. To delete a Quality Team definition, you must first remove all Quality Team members on all records which use it. To simplify this process, an Admin can use the Power Delete Quality Team Members record action, or make it available on the appropriate team enabled object.
Creating Quality Team Roles
After defining your Quality Team, you can also create Team Roles. Vault associates team roles directly with Application Roles, and you can configure these with several options.
How to Create a Quality Team Role
- Navigate to Admin > Configuration > Quality Teams and select the Quality Team for which you wish to create roles.
- In the Team Roles panel, click Create.
- Enter a Label and Name.
- Select a Status.
- Select an Application Role. Quality Team members with this team role are added to the selected Application Role on the object record. You cannot change this once you save the Team Role. See the limitations for Application Roles that can be assigned to a Quality Team Role.
- Optional: Enter Help Content. This will appear to all users who hover over the role label in the Quality Team section of the associated object record detail page. You can use this text to provide clarity around who you can or should select for a role.
- Optional: Select the Minimum Required Users for this role. If you do not select a number, or if you select a minimum of zero (0), this role is optional, and the Quality Team membership may be completed with this role unassigned. To make a role’s membership conditionally optional based on business logic, you can select a minimum of zero (0), then leverage the relevant entry criteria configuration options.
- Select the Maximum Users that can be assigned to this role.
- Optional: Select the Exclusive Membership? checkbox to make the role’s membership exclusive. A team member in an exclusive role may not be a member of any other role on the same team for a given object record. You can configure further limits on role exclusivity using role membership restrictions.
- Optional: In the Linked Field drop-down, select a User object reference field on the team-enabled object. The value of the selected field is be linked to the User assigned in this Quality Team Role on records of that object. This option can only be used if this role definition has a Maximum Users value of one (1). See details about linked User fields.
- Optional: Select a Constraining Application Role to allow Vault to populate the Quality Team assignment options with only users in the selected role. Note that to prevent a role from becoming unfillable, you cannot constrain an Application Role by itself. Constraining roles may be populated by matching or custom sharing rules.
- Optional: In the Cascade Behavior field, select Inherit – Allow Override to allow this role to check the value of the configured Cascade From field on this role. See details about cascade behavior below.
- Optional: Select a role to Cascade From. This field is required if you selected the Cascade Behavior. This field identifies how this team role finds a record to inherit its membership from.
- Optional: Select Locked States. While an object record is in a defined locked state, no Vault user can edit or change this role’s membership, including Vault Owners.
- Click Save. Vault creates the Team Role and associates it with its parent Quality Team.
The new role appears in the list at the bottom of the Quality Team definition page. Vault immediately adds the role to all existing records for the associated object.
Note that if users can change membership while a Quality Team Role’s workflow tasks are active, Admins should design the workflow to handle a lack of verdict due to task cancellation.
About Cascading Behavior
The Team Role checks for a value in the Cascade From field in these cases:
- You select the Inherit – Allow Override behavior in the Cascade Behavior field
- On record creation
- A user clicks Restore while managing a team
If the value of the field is an object record with a Quality Team definition, this Team Role will inherit the membership from that record’s team’s role (matched based on having the same Application Role configuration). If no such record exists, the record has no team, or the record’s team has no role linked to a matching application role, no defaulting will occur.
Users can still manually edit a Team Role’s membership with cascading enabled. In addition, enabling cascading provides users managing the team with a Restore option. With cascading enabled, changes to the linked object record’s Team Role membership cascade down to the record’s team role unless membership of this role has been manually changed.
Note: Atomic Security on Relationships, or an inheriting processes’ Quality Team role constraining roles may interfere with cascading role behaviors. We recommend using locked states as an alternative to Atomic Security on Relationships, and aligning your constraining roles’ population rules to avoid this. You can safely use Atomic Security on Relationships to prevent any non-team-member from changing the membership of any team role.
How to Reorder Quality Team Roles
If you have created more than one role for the Quality Team, their order on the Quality Team definition page matches the order of roles in the Quality Team section on the associated object records.
To rearrange roles, click Reorder. Then, click and drag the roles by their shaded top left corner. Click Save to save your changed, or Cancel to exit without changing the order. Note that you cannot create or reorder roles while editing the Quality Team definition.
Linked Role Fields
Using the Linked Field option in a team role definition can allow Quality Team Role assignments to appear in related lists, searches, filters on library views, reports, and elsewhere in Vault that a User object reference field may be accessible. Once linked to a team role, users or mechanisms may not update a given object reference field, other than via edits to the linked Quality Team Role. See the limitations for this option before deciding to implement it in your Vault.
When you change the linked team role’s membership on a given team-enabled object record, Vault updates the record’s linked field to reflect the new team role membership. The field update is asynchronous; if you change the team on a record, the linked field is updated soon after, but not instantly.
Enabling Linked Role Fields for Quality Teams
To enable linked user field functionality:
- Create an object reference field, referencing the User object, on the team-enabled object. If that object supports types, be sure to associate the field to the same type of object that your team is defined for.
- Add the field in the Linked Field drop-down of the team role definition.
Because this field’s functionality may not be apparent to users viewing the team-enabled object record, we recommend the following:
- Do not add the linked role field to the team-enabled object page layout, or configure security to prevent users from trying to manually edit the linked field. Once linked to a role, Vault will prohibit edits to the field value, and there’s no need to present fields as editable to your users if they’re not actually editable.
- Select the Display on default lists and hovercards object field configuration setting to expose the team role in hovercards throughout Vault.
- Define Help Content for the linked field so that users know they can’t manipulate the Quality Team assignments by changing the field’s value.
Adding Linked Role Fields for Existing Team Role Assignments
Once enabled for objects that already have records with role assignments, Admins may choose an update strategy to update existing records’ fields to match their pre-existing assignments’ values. When updating existing records, affected records may have their linked field’s values changed and Vault updates their modified-date and modified-by information accordingly.
This step is optional. If your organization chooses to keep pre-existing records untouched, you may skip this step. If you wish to update pre-existing records, Vault provides the following methods:
- To blanket update all records which use a given team, click the Sync linked role fields button on the Quality Team definition. This button appears once you select a Linked Field in one of the team’s role definitions. The button starts an asynchronous process to update records with the affected team assignments, linking their values. Vault sends you a notification email including the results of the process in a log file.
- To more precisely update individual or a subset of records using a given team, a similar action is also available as a standard record action:
Sync Linked Role Fields, to be enabled and run on desired team-enabled record. You might use this record action if there are applicable team-enabled records that you do not want to update. For example, if they are already closed or locked.
Sync Linked Role Fields Job Log
The Sync linked role fields process provides a job log, which lists the following information:
- Each team-enabled record that had an assignment
- Whether or not Vault successfully updated the team-enabled record
- Errors encountered
The job skips any records that it cannot update. For example, suppose a role definition had a Maximum Users value of more than one (1), then an Admin changed that Maximum Users value to one (1) prior to adding a value to Linked Field. If there were existing records with teams that have more than one (1) assignment in that role, then the job would not be able to sync the linked role fields for those assignments or records and would log that error in the resulting job log.
Limitations for Linked Role Fields
The following limitations apply to linked role fields:
- The Maximum Users value in the Quality Team Role definition must not be more than one (1).
- A team role can only be linked to a single field.
- While a single linked role field can be linked to several teams, only one role on a given team can be linked to the same field.
About Locked States
Both Quality Team definitions and Team Role definitions include options for selecting Locked States. These states prohibit change to the respective Quality Team or Team Role membership assignments, even by Vault Owners. These options are intended for record end-of-life states, where assignment information must be retained.
Creating Role Membership Restrictions
After defining Team Roles for a Quality Team, you can also create Role Membership Restrictions. In contrast with the Exclusive Membership? checkbox available on a Team Role record, using Role Membership Restrictions allows for team role assignments to be limited among specific existing roles within a Quality Team. A Quality Team must have a minimum of two active Team Roles defined for this section to appear.
How to Create a Role Membership Restriction
To create role membership restrictions:
- Navigate to Admin > Configuration > Quality Teams and select the Quality Team.
- Click Edit.
- In the Role Membership Restrictions panel, click Add Restriction. This button only appears if at least two active Team Roles exist which do not have Exclusive Membership? enabled.
- Select a Role. If a Team Role has Exclusive Membership? enabled, it will appear in the list of roles but you cannot select it.
- Select a value for Is Exclusive With. You cannot assign a team member in the role indicated in the Role field to the role indicated in this field.
- Select a Status. If the status is set to Inactive, Vault does not apply the defined behavior to existing records for the associated object.
- Click Save. Vault automatically creates an inverse relationship between the indicated roles. A team member in the role specified in the Is Exclusive With field will be unable to be assigned as a member of the Role field within the same Quality Team.
The new Role Membership Restriction appears in the list at the bottom of the Quality Team definition page. Vault automatically applies the restriction to all existing records for the associated object. Editing the Quality Team record will allow for the creation of new restrictions, and edit or delete existing restrictions.
Power Delete Quality Team Member Assignments
Note: The Power Delete Quality Team Members record action is designed for Admins. The effects of this record action ignore security permissions. We recommend using this action only during configuration and testing, not on active Quality Event records or in production environments.
During Quality Team configuration and testing you may need to delete a team’s membership assignments on a record in order to make changes to the Quality Team’s structure or behavior. For example, you need to remove a Quality Team role even though there are records which have team member assignments for that role. By default, Vault does not allow you to remove the role (or team) until all team members have been individually removed from all records.
The Power Delete Quality Team Members record action completely clears a Quality Team’s membership assignments for a specific record. The action deletes membership assignments only on the current record, regardless of the team or role’s cascade configurations. This action also deletes orphaned membership assignments caused by, for instance, changing the type of a Quality Event record that already has Quality Team membership assignments.
How to Configure Power Delete
You must set up this action individually for each object where you will want to use it. To configure the Power Delete Quality Team Members record action:
- Navigate to Admin > Configuration > Objects and click into the intended object.
- In the Actions tab, click Create.
- In the Create Action dialog, select Power Delete Quality Team Members in the drop-down.
- Click Continue.
- Optional: Select the checkbox Available in All Lifecycle States to make the record action available in all lifecycle states. If selected, Admins can configure Atomic Security to further restrict access to the Power Delete Quality Team Members record action.
- Click Save.
- Optional: If Available in All Lifecycle States was selected, make selections in the Atomic Security dialog box for object lifecycle states in which this action should be available, then click Save.
The Power Delete Quality Team Members record action should now be available on related object records. Note that by default, enabling this record action makes it available on base object types only. You can enable it for additional object types in the Object Types tab.
Note: Disable the Power Delete Quality Team Members record action before performing configuration migrations into production, or opening the Vault for production use.
Reporting on Teams
You can report on your Quality teams and team members to easily assess scope and efficiency. Navigate to Admin > Configuration > Report Types to set up team member reporting. See About Report Types for more information.
- Vault does not support Quality Team roles linked to Sharing Settings roles that use rule-based groups (Dynamic Access Control and custom and matching sharing rules).
- Vault does not allow the establishment of new team roles against a sharing settings role with any rules, but does not prevent Admins from adding such rules to already established roles that already have team roles for.
- In the event that an Admin adds rules to a team role’s application role, end-users will receive an error when they attempt to Manage Team on any object record using that team.
- You cannot create a Quality Team for an object that has more than one parent object reference, nor can you create a Quality Team for an object under two or more levels of parent object relationships.
- Vault does not allow configuration of a Quality Team for a child object.
The following standard Application Roles cannot be selected for a Quality Team Role:
- Process Viewer
- Document Change Control Approver
- Document Change Control Reviewer
- External Collaborator (Audit)
- Direct Manager
Related Objects & Terms
- Team-Enabled Object: An object you have defined a team for.
- Team-Enabled Record: An object type record that leverages a team.
- Quality Team Members Object: A system-managed object that Vault creates when you create a team. It stores the team role assignments of users for specific team-enabled records.
- Quality Team: This component defines a Quality Team you’ve created in your Vault. It defines the structure of the team by associating Quality Team Roles and team behavior as a team-enabled record moves through its processes. It is associated to an object or object type in order to declare records of that object or object type to use a team.
- Quality Team Role: A role defining which security rights members have and by which role they are constrained. This component defines the roles that are available or required for object records leveraging the associated Quality Team (Change Owner, Primary Investigator, QA Approver, etc). These roles link to sharing settings roles such as Owner, Reviewer, and Editor. The component further defines the behavior of these roles. For example, you can define the minimum number of users required to complete a team, the maximum number of users allowed on a team, and whether or not you can select users from any group in the Vault or from a specific role on the team-enabled record.
- Quality Team Role Membership Restriction: A component defining a Role Membership Restriction that defines Team Role exclusivity within a specific Quality Team. These restrictions are defined manually, with Vault establishing a bi-directional relationship between two roles that are exclusive to one another. For example, you can define a restriction that does not allow a user with the Owner role to be assigned as the Approver. Because of the bi-directional role relationship, Vault also automatically restricts the user given the Approver role from being assigned as the Owner without having to define an additional restriction.
To view the team members section, a user requires Read permission on the relevant team-enabled object.
To add, remove, or otherwise manage Quality Team members, a user requires Edit permission on the relevant team-enabled object.
The ability to edit Quality Teams on team-enabled objects in a given lifecycle state also depends on the lifecycle’s Atomic Security on Relationships or locked state configuration.