Skip to end of banner
Go to start of banner

Workflow and Mockups

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 87 Next »

Current Workflow

Use Cases for this Workflow can be found here.

Setting up the Access Requirement

ACT has been using an R script to create Access Requirement on a set of entities (data set). On some data set, there will be multiple Access Requirements: ACTAccessRequirement, and SelfSignAccessRequirement.

Example form:

Link to instructions: https://www.synapse.org/#!Synapse:syn2954404

Requesting Access

Dataset A has ACTAccessRequirement. User B wants to download dataset A, s/he needs to email the ACT to request access to data set A. Via emails, an ACT member would ask the user to complete some forms. The forms are different for each dataset. A form includes the information that Sage and data contributors requires. It is an agreement between Sage and data contributors, so it will not change after it's established for a data set. When there is updated on the data set, we have the data in a different project/ folder and have a new set of Access Requirements on that data.

Each request may request n number of users to access the data. A request normally includes information about the institution, the signing official at the institution and the research statement for the project that the list of accessors are working on. Some request requires accessors' signatures, some requires other certificates. For human sensitive data, the request requires that accessors have their Synapse profile validated.

Granting Access

After the users meets all requirements given by the ACT (via emails), an ACT member would go to the dataset and manually enter the user(s) and run an R script to give the user(s) access to the dataset.

Updating Information

When someone leaves an institution, a requestor will email the ACT about removing a member from their request. The ACT will manually remove this user access.

When a new member join a lab, a requestor will email the ACT about adding a new member to their request (and their signatures in some cases). The ACT will manually grant the new user access.

Renewal

Every month, an ACT member will loop over all requests to see which one will expire in a month and send an email to the requestor to remind them about updating their request. If s/he does not response, the ACT member will email other members in their request.

Exporting Information

Every few months, an ACT member will download all DUC forms and Intended Data use Statement in that period and send them to the data contributor.

Since the request information is kept in a spreadsheet, a script is run that gathers public information from this spreadsheet and publishes to a wiki: Principal Investigator, Institution, Date, and Intended Data Use Statement.

Disadvantages:

  • Manually entering the detailed information (in a spreadsheet) about the request for access (including approval status) is a burden for the ACT.

  • User's handwriting is hard to read.
  • Since requests are submitted via email, there is no ways to prevent requests coming in with missing information.
  • Keeping track of which request is about to expire and emailing reminding users about their expired request takes a lot of time.

Proposed Workflow

Setting up the Access Requirement

The ACT member will navigate to a page specifically for managing AccessRequirement and DataAccessSubmission.

From an entity page, an ACT member can choose 'Manage Access Requirement' from Tools:

If there is no existing AccessRequirement associated with the entity, an ACT member will be asked to create one.

If there is one or more AccessRequirements associated with the entity, an ACT member will see the following view:

An ACT member can also enter the Access Requirement Manager with a fix URL. 

From there, an ACT member can Create a New Access Requirement, Search for one, and Manage access request.

An ACT member can search for Access Requirements that applies to an entity or a team:

An ACT member can see all ACT Access Requirements that have submissions that need to be reviewed:

When an ACT member choose to create a new Access Requirement, they will be asked to provide the necessary information: 

For PostMessageContentAccessRequirement:


For TermsOfUseAccessRequirement:


For ACTAcessRequirement:


After creating an AccessRequirement, an ACT member will be directed to a page to manage the created AccessRequirement:

For an ACTAccessRequirement, an ACT member will find the DataAccessSubmissions that need to be reviewed:

Requesting Access

From a controlled entity page, a user will see the "Show unmet conditions" button:

Clicking on "Show unmet conditions" takes user to a page that shows all AccessRequirements applied to the entity:

From there, user can Create, Update their DataAccessRequest, and Cancel their submission.

Clicking on "Create Request," a dialog will show the ACT instructions to the user:

After reading the instructions, a user click "Next" and provide information about their project:

After entering the information about the research project and clicking "Next", user will be prompt to enter the list of accessors and upload required documents:

Once user provided all required information & document, they will be able to submit their request.

Granting Access

After a user submits a request, an email will be sent to the ACT team:

An ACT member can click on the link provided in the email to go to the Access Requirement Manager page, or navigating to this page from other options described above. The link in the email take an ACT member directly to a location that manages submissions for a particular Access Requirement.


After reviewing a submission, an ACT member would click "Approve" to approve the request. This action will create an AccessApproval for each accessors in the approved request.

If the ACT member decides that the request does not meet the required conditions for any reason, he/she would choose "Reject." The ACT member will be asked to provide instructions on how to complete the request.


Updating Information & Renewal

After a request has been approved, the requestor will receive an email from Synapse:

After a request has been rejected, the requestor will receive an email from Synapse:

The requestor can use the provided link to navigate to his/her request and start making changes.

For renewal request, user will be prompt to provide summary of use after they update the existing info:



After the request has been approved/rejected/expired, the requestor can opt to update their request:

The requestor will be able to edit all submitted fields:

On clicking Update, if anything is not filled in, the user will be shown an error message instructing them to fill in any fields they left blank.



To view all requests made on the dataset, an ACT member can navigate to the page for managing the Access Requirement associated with that dataset and inspect the table of requests.

Features of the table view:

Users that have been certified or had their profile validated will have a symbol next to their synapse id (in this case a trophy, though will likely be a shield) as an indicator.  Users who have previously been approved for access to the dataset will have a check mark next to their name.  

The ACT member can query the table to only show requests that are awaiting approval, or only ones that were approved or rejected.  The latter requests will have their approve/reject buttons disabled.

If the requestor updates their request, the fields they change will be highlighted for the ACT to more easily see. The version of the request will be incremented.  The ACT member viewing the table will be able to view all previous versions of the request by clicking the "View Versions" button.  Doing so will open a dialog with the previous versions of a request:


After the set expiration length of time has passed, an access request will need to be renewed.  An email will be sent out to the list of accessors one month before the expiration date.

<TODO: add sample email for one month before expiration>

If the request is not updated, then it will expire.  The version in the table will be incremented, access for all accessors will be revoked, and the status will change to EXPIRED:

An email will be sent to the accessors (and ACT) notifying them of the revocation of their access.

<TODO: add sample email for revocation of access due to expiration>



Now the ACT member can view the user request and their submitted form before approving their request with the approval button. Approval may grant access to one user, or to many (ACT will decide based on request).  Clicking approve will open a dialog with a summary for the ACT member to double-check before approving, including the ability to edit the email being sent out upon approval:

Sample email message to researcher after their request has been approved:

____________________________________________________________________________________________________________________________________

Hi:

The Synapse Access and Compliance Team has approved your application for use of the MayoGWAS data distributed through Synapse.

To use this data you must adhere to the Terms of Use as described in the MayoGWAS DUC: https://www.synapse.org/#!Synapse:syn2910256

The MayoGWAS data can be accessed through the following Synapse project:https://www.synapse.org/#!Synapse:syn3219045

Please note that the first time you download a datafile you will also be asked to agree to acknowledge the AMP-AD Partnership in publications derived from any of the AMP-AD data. This approval must be performed through the website.

For a review of the AMP-AD Data Terms of Use, please see here: https://www.synapse.org/#!Synapse:syn2580853/wiki/78604.

Please note, this email is sent from an unmonitored account. Send any questions to act@sagebase.org.

Sincerely,
The Synapse Access and Compliance Team

____________________________________________________________________________________________________________________________________
  
When the ACT chooses to reject a request, he/she will given a reason for rejection. An email will be sent to the requestor about the rejection. The email will include the reason and a link for user to create a new request based on the previous (rejected) one.
Sample email message to researcher after their request has been rejected:

____________________________________________________________________________________________________________________________________

Hi:

The Synapse Access and Compliance Team has rejected your application for use of the MayoGWAS data distributed through Synapse, because you did not sign the DUC.

To submit another request, please visit the MayoGWAS dataset at: https://www.synapse.org/#!Synapse:syn2910256.

Please note, this email is sent from an unmonitored account. Send any questions to act@sagebase.org.

Sincerely,
The Synapse Access and Compliance Team

____________________________________________________________________________________________________________________________________


Exporting Information

The data contributor wants to know who has access to their data. Sage has been given report about approved requests including the following information: Principal Investigator, Institution, Date, and Intended Data Use Statement.

Brian has a script that update this wiki: https://www.synapse.org/#!Synapse:syn4993293/wiki/392026

For auditing purposes, ACT member could query requests (find requests that need to be processed, find requests that have been approved and see when they were approved, etc). ACT member could export set of files (associated with the dataset requests) as zip file, to be sent to data contributor.



  • No labels