Align Security Tree Management

Align can now maintain a Security Tree in Vault CRM using a structure that mirrors the territory hierarchy within Align. Security Trees are a Vault Platform capability that enable customers to configure their own hierarchical security mechanism. While territory assignment controls access to accounts, the Align Security Tree controls record-level access to other objects that are relevant to a user's job, for example Time off Territory, Coaching Reports, or Multichannel Cycle Plans. This ensures that users have access to only those records that relate to themself or their subordinates.

For example, a cardiology end user assigned to the UK_CARDIO_SOUTH_LONDON territory is also assigned to the UK_CARDIO_SOUTH_LONDON Security Tree node, which controls access to the records related to that user or others assigned to the same node. Her district manager, assigned to the UK_CARDIO_SOUTH territory and Security Tree node, has access to the records secured by that node and by the nodes beneath it in the tree.

Align assigns each user to a single Align Security Tree node. Vault then uses User Reference Assignment to automatically assign records to the correct node based on a specified User field (typically the Owner field). Customers can choose which objects use this security model.

Who can use this feature?

Configuring Align Security Tree Management for

To configure this feature:

  1. Ensure the following features are configured:

  2. Navigate to Admin > Users & Groups > Permission Sets.
  3. Select the appropriate Permission Set.
  4. Select Objects.

  5. Grant the following permissions:

    Object

    Object Permission

    Object Types

    Fields

    Field Permission

    aln_security_tree_node__v

    CRED

    All

    All

    Edit

    aln_territory__v

    CRED

    All

    crm_security_node__v

    Read

    aln_security_tree_node_c__sys

    CRED

    All

    All

    Edit

    aln_roster_member__v

    CRE

    All

    crm_security_tree_node_override__v

    Edit

    All intersection security tables created for objects controlled by the Align Security Tree. See Security Tree Administration for more information.

    CRED

    All

    All

    Edit

To configure this feature:

  1. Ensure the following features are configured:

  2. Navigate to Admin > Users & Groups > Permission Sets.
  3. Select the appropriate Permission Set.
  4. Select Objects.

  5. Grant the following permissions:

    Object

    Object Permission

    Object Types

    Fields

    Field Permission

    aln_roster_member__v

    CRE

    All

    crm_security_tree_node_override__v

    Edit
  6. Navigate to Admin > Configuration > Objects > aln_roster_member__v > Layouts.
  7. Place the crm_security_tree_node_override__v on the appropriate layouts.
  8. Navigate to Align > Align Admin > Align Settings (Production).
  9. Edit the Global Align Settings record.
  10. Select the Security Tree value for the Manage CRM Features multiselect picklist.

Defining Objects Controlled by the Align Security Tree as

Align Operational Users maintain the territory hierarchy and the roster member assignments in Align, and Align maintains the corresponding Security Tree in Vault CRM. To define which objects are controlled by the Align Security Tree:

  1. Navigate to Admin > Configuration > Objects.
  2. Select the appropriate object.
  3. Select Edit.

  4. Populate the following fields:

    • Security Tree Object – Select Align Security Tree Node
    • Tree Assignment Object Name – Enter the appropriate name
    • User Reference Assignment Field – Select the appropriate field used as the basis for tree node assignment. For example, owner__v.
    • Restrict Users to a Single Node Assignment – Select this checkbox. This enables records to be auto-assigned to Align-managed Security Tree nodes.
  5. Select Save.

See Security Tree Administration for more information.

Maintaining the Align Security Tree as

Nodes of the Align Security Tree are automatically created and maintained during Pushes to CRM.

The root node is automatically generated during the first push after enabling this feature and must not be renamed.

Nodes are automatically created and arranged to mirror the Vault CRM instance’s territory hierarchy, and users are automatically assigned to the Align Security Tree node corresponding to their assigned territory.

If a Roster Member has multiple active territory assignments, Align operational users must ensure at least one of the following conditions are true in order to avoid a sync error:

  • Ensure the roster member has exactly one Primary Territory defined
  • Populate the crm_security_tree_node_override__v field on the appropriate aln_roster_member__v field with the appropriate node

Once assigned, users can access any record assigned to their node and, conversely, are prevented from accessing records assigned to other nodes. Users assigned to parent territories (for example, managers) can view all records assigned to their node, as well as any record assigned to descendent nodes.

Transfers in the Align Security Tree

When an end user transfers to a different territory, Align automatically reassigns records that they own to their new Security Tree Node. This enables the end user to continue to access data that they own, and also grants their new manager access to the transferred records.

Related Topics

Managing Users in Align

Security Tree Administration

Territory Management Overview