RightCrowd SureSite Access Request - Workflow
Purpose and Scope This document details the Queensland University of Technology (QUT) SureSite workflow definition, which processes requests for Cardholders requiring: The ability to add a user into SureSite as an Authoriser (Building Authority) The ability to add additional schedules to door/access levels (Door/s/Room Usage) The ability to request access to doors/access levels (Area Access) This document details the contents of the following form; Access Request Form Request access to access levels (access groups in Cardax) for existing cardholders. A cardholder may request to access a specific area. Notifications will be send to the appropriate authorizer.the Requestors action will add an access level to the cardholder and the Authorisers action will approve/delete the access level. Copyright 2012 RightCrowd Software Pty Ltd.
Table of Contents Introduction... 2 SureSite Workflow Concepts... 2 Work Tray... 4 Work Item States... 5 To Create a New Work Tray View... 5 Creating a Workflow Request... 8 Workflow Definition Overview... 9 Workflow Process... 9 Form - Step Transitions... 10 Workflow Process - Illustrated... 10 Form Elements: Access Request Form... 11 Cardholder Details Tab... 11 Field Descriptions Access Request Form: Cardholder Details... 12 Cardholder Search Button... 13 Request Details Tab... 14 Validation Tab... 15 Saving Changes... 15 Submitting a Form... 15 Notifications... 16 Approving Forms... 17 Approval Tab... 18 Bulk Approvals... 19 Working With Forms... 20 Workflow Permissions... 20 Claiming Forms... 20 Cancel Claim... 20 Transferring & Assigning Forms... 20 Delegation... 20 Approver Roles... 23 1
Introduction This document explains Workflow Definition requests, whereby any user with the appropriate network account can request access to via SureSite. Cardholders must exist in SureSite before a Request can be submitted on their behalf. Workflow Request forms are available for selection from the Forms page, under the SureSite Workflow menu. Successfully completing and submitting a form will trigger an Approval Process. SureSite Workflow Concepts This section introduces SureSite Workflow features and functionality for those unfamiliar with the product. The SureSite Workflow Work Tray is the user interface for interacting with in-progress Workflow processes. It displays work item requests that are relevant for the logged-in user, based on their security profile. SureSite Work Tray Each item that appears in the Work Tray is known as a Work Item. A Work Item represents a step in the workflow process for a given Request. Items that appear in a user s Worktray indicate that the item is awaiting action from the user (or users with the same privileges) so it can progress in the Workflow. The following columns are provided in the Work Tray s default System View: 2
Column Work Item Name Type Step State Description The name of the Applicant (with the designated Approver s name suffixed to the Applicant s Name in parentheses). The type of request (based on configuration). The current step in the workflow request process. The current State of the request: New A New Work item has been created and saved but has not been submitted and therefore is not entered in the Workflow process. Available The work item has been submitted and is ready to be actioned. It is not yet claimed by a user. Claimed A work item is allocated to a specific User and is unavailable to all other Users. Priority Last Modified Date Attributes Completed The work item step has been actioned and the work item has moved to the next step. The Priority level that has been assigned to the request. A status date-time value, showing the last time that the request was updated. Attribute fields provide additional information regarding certain fields within the form. Items that have finished processing are removed from the Work Tray. SureSite Forms are used to create new work item requests. For example, when a cardholder requires access to a specific area which has not been automatically provisioned via SureSite rules, an Access Request form must be completed in SureSite. Available forms are accessed from the SureSite Workflow menu. Mandatory fields must be completed, and details must be verified, before the form can be submitted. When a form is submitted, a new work item appears in the Work Tray. 3
Work Tray 4
Work Item States When Work Items arrive at a new Workflow step they have a state of Available. When a User chooses to Edit a Work Item, the state of the Work Item is changed to Claimed. Claiming the Work Item has a number of implications: The Work Item can only be claimed by one User at a time. Only the User who has claimed the Work Item is able to edit it. Once the Work Item is claimed it is removed from the Work Tray of other Users and is only visible to the claimant. To cancel a claim, Edit the Work Tray item and click the Cancel Claim button. System Administrators can: View and edit Work Items that have been claimed by someone else. Transfer a claimed Work Item from current User to a different User. Cancel a claim on a Work Item (move the state back to Available). Assign an available Work Item (assign the Claimed User and change the state to Claimed). A Workflow can be saved at any time in the process, even if it has not yet been submitted. If saved, the Workflow will be available in the Work Tray in Draft step. Only the original Requestor can Cancel a Workflow, and this can only be done in Draft or Redraft steps. Work items appear in the Redraft state after an Area Access Manager has requested More Information during the approval process. To Create a New Work Tray View If desired, you can create a more personalized view of the Work Tray and make it the default view. From the Work Tray, click on the Views button and select Create New View. Customize the tabs as required then click Save. The diagrams below illustrate the process. Note: You cannot edit the System view. 5
6
7
Creating a Workflow Request From the SureSite main menu, select Workflow then New Form. There are 3 forms available. Depending on your security privilege level, you may see one, two or all three forms. # Form Name Students Staff Authorizers System Administrators 1 Access Request Y Y Y Y 2 Building Authority Request N N Y Y 3 Door / Room Usage Request N N Y Y The processing of a form may involve several stages, depending on the complexity of the business process involved. For example, a request to provide site access for Staff or Students may involve review and approval by multiple Users with manager-level security profiles before access is granted. The logical process that manages these work item stages in SureSite is called a Workflow Definition. 8
Workflow Definition Overview Workflow Process A workflow process is required to facilitate the submission, review and approval of a Request. The table below represents the steps that have been defined for the workflow process and provides a high level summary of their purpose. Step Draft Purpose First step in the workflow process. Is not committed to the database until it is either saved or submitted. Is launched from the New Form menu within SureSite. The user can choose to: Cancel, Save or Submit for approval. This function can be performed by all users of the system. Approval To validate information and obtain initial approval of the Request. Can be performed from work tray or email response. The user can choose to: Reject the request, Request more information or Approve. This function can be performed by Users who have the correct privileges assigned to their Role i.e. a SureSite role of Authoriser can be configured to have the ability to approve work flow requests Redraft To update the request should it have insufficient/inaccurate information. Can be performed from the work tray only by opening the form. The user can choose to Cancel Request or Resubmit. This function can only be performed by the initiator of the request. Rejected Approved Cancelled Conceptual step only and is used in the diagram to better illustrate the process flow. Conceptual step only and is used in the diagram to better illustrate the process flow. Conceptual step only and is used in the diagram to better illustrate the process flow. 9
Form - Step Transitions The table below details transitions between steps and identifies when each transition will occur: Transition From Step To Step Logic T01 Draft Approval ALWAYS (when submitted) T02 Draft Cancelled When Cancel Request is actioned T03 Approval Rejected When ApprovalDecision field is set to Rejected T04 Approval Approved When ApprovalDecision field is set to Approved T05 Approval Redraft When ApprovalDecision field is set to More Information T06 Redraft Approval When the request is re-submitted T07 Redraft Cancelled When Cardholder is not authorised When Cancel Request is actioned Workflow Process - Illustrated The following diagram illustrates the workflow definition process for each form: 10
Form Elements: Access Request Form Select New Form from the SureSite Workflow menu to create a new request. Click Create Request to load the Access Request form and display the Cardholder Details tab. Cardholder Details Tab 11
Field Descriptions Access Request Form: Cardholder Details Item Label Description Is this form request for: Options: You, An Individual, Group 1 Access Point Details 2 Faculty/Department Area 3 Door 4 Activation Date 5 Expiry Date 6 Cardholder Details Cardholder Cardholder Type Membership QUT Access Name Comments Reason for Request Add new comment Buttons By default You is selected. This will prefill the Cardholder Details area with the person logged into SureSite. The You option is locked for Students. Non Students can select An Individual or Group. If the user changes from You to another option then the Cardholder Details will be cleared/updated accordingly. QUT is organized into various Faculties and Departments, select the appropriate option. The option selected will determine the next step. Each Faculty or Department is further filtered into General and Restricted access, select the appropriate option. The Door filed represents a list of doors associated to the area selected above it. Optional: Set an Activation date for access to start (click calendar icon to select date). Optional: Set an Expiry date for access to end (click calendar icon to select date). Click the associated button to activate the cardholder search function. SureSite will display a pop-up search window. e.g. Staff or Student etc. Will be loaded automatically or via the cardholder search function. e.g. Information Security Institute. This field is mapped to the membership value on the cardholders profile in SureSite. Will be loaded automatically or via the cardholder search function. This field is mapped to the QUT Access Name value on the cardholders profile in SureSite. Will be loaded automatically or via the cardholder search function. Optional: provides a list of predefined answers Optional: Provides the user the option to create a comment if desired or where a predefined reason will not accurately describe the reason of the request. 12
Item Label Description Previous, Next Cancel Request Save Validate Submit Submit and Clone Navigate forwards or backwards through the form Cancels the form Enables the form to be saved and returned to The validate button can be pressed at any time and will check if all mandatory fields are completed and if there are any errors. A green tick indicates a correct state whilst a red x represents an error. A form cannot be submitted if any validation errors are outstanding. Sends the form to be processed into the next phase of the workflow process (see section on Workflow Process Definition) This button replaces the standard Submit button and will be available if Group is selected in the first field. Use of this feature will enable the main contents of the form to be duplicated which will save time in reproducing the form from scratch. The user is required to enter the Cardholder details for each cloned form. Cardholder Search Button Click the Cardholder Search button and the popup window below provides the option to search for a cardholder. Search by First Name or Last Name or both. The grid to the right displays results. Double click on a cardholder to populate that cardholder into the form. 13
Request Details Tab The Request Details tab captures particulars about the form, including who is lodging it, and provides the option to send a notification (CC) to a 3 rd party during various steps in the Workflow process. Item Label Description Request Information 1 RequestID Non Editable: A system generated ID. Each form is given a unique ID. This can also be used to search for the form. 3 Request Date Non Editable: Date the form is created. Will default to today s date. Cardholder Details Requestor Name Non Editable: The cardholder completing/creating the form Requestor Email Email address of the cardholder completing the form. Optional Name This field is mapped to the QUT Access Name value on the cardholders profile in SureSite. Will be loaded automatically or via the cardholder search function. Email Optional: Provide an email as a CC type notification. 14
Validation Tab On clicking the Validate button, the form requestor will be immediately directed to the Validation tab (you can also click on the Validation tab directly). The validation process checks form content for errors and indicates the status with green ticks or red crosses (as seen below). Typical errors include illegal characters and missing/incomplete information. The validation summary is categorized (i.e. Cardholder Details, Request Details ) in-line with each tab within the form (excluding the Validation tab). Saving Changes If a user attempts to close the form without saving, they will be prompted: Do you want to save changes you made? On Redraft the requestor has the option to Refresh the Applicant Details from SureSite CDF s. This ensures the most recent Cardholder data is incorporated into the request. When the Cancel button is selected, the user is prompted: You are about to cancel this claim. Are you sure you want to continue? Submitting a Form Click the Submit button and the form progresses to the next step e.g. Approval or Redraft. A form cannot be submitted if validation errors exist. 15
Notifications When a form is submitted, it generates an email notification. A notification may be sent to an Approver or a Requestor or a 3 rd party (if the optional CC email was completed within the form) depending on the forms transition step (Draft, Redraft, Approval). The content and stage of the Workflow determines who gets a notification. The content of each notification will vary (i.e.an Approver s message will differ from a Requestor). Note: The 3 rd Approver. party (CC) recipient will receive the same notifications as the Requestor and not the Based on QUT s workflow model, a notification is purely a communication medium: it does not trigger any rules or processes within SureSite and it is not connected to the requestor or approver s email address (i.e. you cannot reply to a notification anticipating the sender will process the message). Note: Notifications will be broadcast to all users within an Authorization Group. Authorization groups are setup in line with QUT s Faculty and Divisional structures. For example, if a request is for access into the Faculty of Law Restricted area, then only users who are members of the Faculty of Law Restricted group will receive the notification. The form is available to be claimed and processed. The following is a sample notification sent to a Requestor (Joe Bloggs): Dear Bloggs, Joe The following Area Access Request has been approved. Request ID: 000389 Access Requested: Faculty of Law Faculty of Law - Restricted 26-3-D-P Cardholder Details: Cardholder: John Smith Cardholder Type: Student Membership: UO87 - Bachelor of Engineering QUT Access Name: student_1 Approver's Comments: Access was approved by Test, Staff_2. Note: The same message above would be sent (CC) except the name (Joe Bloggs) will be replaced with the name entered on the Optional Details section on the Requestor tab. Note: Workflow email notifications contain a link directly to the your Worktray if applicable (Requestor & Authorisers) 16
Approving Forms When a form is submitted by a requestor it appears in the Approver s Work Tray. The form is only visible to Approvers within the Authorization Group for which the form was intended. Opening the form will reveal an additional Approval tab (not visible during the Request step). It is expected that an Approver will review all contents within each tab in assessing the request prior to approving it. Certain fields within the form will now be locked/greyed out. These fields are not editable by an Approver. The fields that are editable (e.g. Activation and Expiry dates) can be entered or overwritten at this step. Click the Next button to advance through each tab until the Approval tab is reached. 17
Approval Tab The approval Tab is only accessible to Approvers. It captures who the approver is and their decision. It also provides the option to enter comments. The option to save the form and return at a later point is available provided if the Approver does not want to click the Submit button yet. Item Label Description Authorizer Approval 1 Actual Approver Non Editable: System populates the field with the logged in user 3 Approval Decision Approved - On Submit, trigger system to add door to cardholder record, system generates automatic email notification to requestor, Workflow item complete More Information - On Submit, return form to requester with further instructions, system generates automatic email notification to requestor, form drops off Authorizers Work Tray and is transferred into Requestors 18
Item Label Description Worktray Comments Add New Comment Rejected - On Submit, cancel form, system generates automatic email notification to requestor, Workflow item complete Note: An Approver cannot submit a form without selecting an Approval Decision (this will register as a validation error). Note: An Approver cannot Request More Information or Reject a workflow request without entering a comment (this will register as a validation error) Bulk Approvals Bulk approvals are possible for the Access Request form only. The Access Request form also provides a Submit and Clone option. At the base of the Worktray screen, select the down arrow beside Bulk Action. The workflow items will be filtered to only display forms available to be bulk approved. Click the checkbox beside each form you wish to approve then select Process. 19
Working With Forms Workflow Permissions Roles dictate which actions users are permitted to execute. The following table defines which roles can execute actions available at each step of the workflow. Permission Create Request (Draft) Update Request (Redraft) Authoriser Approval Roles SureSite Role General User, Staff, Authorizers, System Administrators Original Requestor SureSite Role Authorizer * (see list under Approvers below) Claiming Forms Once a form is claimed, it is no longer visible to other authorizers within the same Authorization group i.e. it is now sitting with one authorizer in a single worktray not multiple. System Administrators can still view all forms regardless of the forms state (available, claimed etc.). Cancel Claim If a form is claimed it can be cancelled by the Authorizer who claims it simply by clicking on the Cancel Claim button within the form. Once a claim is cancelled, the form state returns to Available and returns to the worktray of every authorizer within the same authorization group. A claim can also be cancelled by a System Administrator. Transferring & Assigning Forms Provided you have the appropriate privilege you can Transfer a claimed Work Item from current User to a different User and also assign an available Work Item (assign the Claimed User and change the state to Claimed). Delegation From time to time an Approver may be required to Delegate their approval or review responsibility to another authorized User (e.g. an Approver is going on annual leave). The Delegations menu item will only be displayed if you have the relevant Privileges to view this. As an Approver, if you know you will be unavailable for a set period of time to manage your Work Items, you should delegate your Approval Role in the Delegation screen. 20
Once a Delegation has been set, if it needs to be adjusted or rescinded, then the Delegation needs to be cancelled (your current Delegation will be displayed and can be cancelled by clicking the Cancel Delegation button). Note: Once a delegation has been set, it cannot be adjusted. If you need to change it, you must cancel the delegation and set it again. A User will need to have a Delegation permission via their Role to be able to see or use the Delegation option (it is only available to current Approvers or Admins): o o o The screen will provide each User with their current delegation status who they are delegated to (blank by default), the From Date and To Date for the delegation. The list in the Who field will be any Approvers (these are Users that are assigned to any of the Approver Roles). Default Start Date = Today o Default End Date = Today + 1 o o End Date cannot be prior to Start Date End Date can equal Start Date The User will click on Set Delegation to update their delegation details. At any time, the User can use the Delegation menu option to see their delegation settings. To change the setting, the User will need to Cancel Delegation and Set Delegation with the new desired settings (retract, extend, etc) The Cancel Delegation and Set Delegation actions will create Audit Log entries for reporting purposes. The person that has been delegated will receive an email notification. 21
From the time that the delegation becomes active until the time it expires, the person who has been delegated to will: o o See any Requests that the original User could have claimed in their Work Tray and be able to process them. Receive an email notification of any Requests that were assigned to the delegated User. For example: if Jane delegates to John, the Requestor selects Jane from the Approver list on the Form, but John actually receives the Approval email. A delegated user can delegate their approval (and the person for whom they are a delegate) to another Approver. For example: if Jane delegates to John, then John delegates to Peter, then Peter receives the Approval email for Jane s and John s approvals. Peter can see any Requests that both original Users could have claimed in their Work Tray and process them. If there were any Claimed Requests for the original User when they delegate, then a warning will be provided to them: o o If they proceed, then an Administrator will need to transfer all of these Requests manually to another User to get them actioned. There will be a Bulk Transfer action added to the Bulk Actions list to facilitate this When a delegation period ends, if the User who was delegated has some Claimed requests (for the original User) outstanding, then the same Bulk Transfer process will have to be performed where they need to be actioned and the User no longer has the permissions to complete this. Note: AD integration (available with SureSite) can also be used to allow the User / Roles to be maintained in AD through IT processes. These changes can then be replicated through to the relevant SureSite Workflow Roles automatically. 22
Approver Roles Approvers are allocated to Divisional structures and determine who can approve access to specific areas. This is managed in SureSite using Roles, which indicate the Authorization groups (extract illustrated below): Each Role may have more than one user assigned to them. Based on the Door (Access Level) selected during the Workflow form process, that door will be associated to a specific Faculty/Department area. 23