Locking a workflow for validated process (GMP)Hi all,
I have a customer who fell in love with workflow builder. What they need in order to apply it to regulated, validated processes would be a way to lock steps or the entire workflow, to assure that the method of analysis cannot be manipulated.
Does somebody have an idea how to accomplish this? Did I miss an option to achieve this, maybe?
Thanks for your thoughts and input!
Best regards from Heidelberg,
Florian
Re: Locking a workflow for validated process (GMP)Maybe there's a better way, but they could always get the script from Workflow Builder and encrypt it to require a 'Decrypt' and/or 'Run' password (or both). If lots of folks are using it, you would probably want to put this in an add-in with a menu option.
Re: Locking a workflow for validated process (GMP)Thank @ian_jmp . That's definitely an option or maybe the way to go. It would actually be nice to have that built into workflow builder 
Re: Locking a workflow for validated process (GMP)There is nothing of the kind built into workflow builder. Can you elaborate on what the user request is?
Does the user have Workflows that fully perform a process? I.e. they require no user intervention.
The user can perform actions after the workflow has completed. Is that a problem?
Or are these just "scripts", not actual analysis?
Re: Locking a workflow for validated process (GMP)@ErnestPasour - Hey, just going to chime in on this because I expect a lot of our Pharma/ biotech's to bring similar requests.
The issue is kind of like with software development. There's a point where you guys lock down the codebase for a version, do a final set of quality checks, and then release it in a state it can't be changed by the end user. They basically want to be able to do something similar.
They want to be able to verify that a workflow is running as expected on a standard data set (like what we do with our NIST verification tool) and then lock the workflow down so that it can't be changed. The data going in and the results coming out of the workflow will be different from the test case when it's used in the wild. The point is that they've verified that the workflow is producing expected results under controlled test conditions and that it can't be modified after that verification process. Any prompting, dialogs, etc. would be part of that verified workflow.
I don't know if @Florian_Vogt put it in the Internal Wish List, but this would be a good addition to WFB's capabilities as an LRT option and I'd expect to hear more requests for it from our customer base as 17 gains traction for work in validated environments.
Best,
M
Re: Locking a workflow for validated process (GMP)Okay, thanks @MikeD_Anderson , that clarifies things a little bit. So, one way to implement this might be that a workflow is "locked" and nothing can be changed if the document is readonly on disk. The workflows could be stored in a source control system for safety, but if end users can only access on a readonly copy (either from source control or a shared drive), then they wouldn't be able to modify them.
However, I still wonder: are we concerned about accidental modifications (in which storing in source control handles most of the issues) or preventing people from working around perceived shortcomings in a blessed workflow? It's definitely harder to prevent someone from doing something else in JMP that would evade whatever restrictions are built into the workflow.
A list of some things that users might do that you want to prevent could be helpful in fleshing out the requirement here.
Re: Locking a workflow for validated process (GMP)The read-only idea is definitely an option. If they had a Sharepoint site or something that that could manage that from it would be one possibility. And, you're 100% right - there's definitely some business-processes and standard operating procedures the user's company is going to have to implement regardless of what JMP does. I think the best we could do (if it makes sense from your end) is meet them half-way and then say it's on them to set up the governance strategy.
I think the concern is with any modification - accidental or intentional. I think there's some active defense going on in this question. Locking something down may be a way to define an SOP in the event of an audit or something. But, that's just a guess.
Re: Locking a workflow for validated process (GMP)Hey @MikeD_Anderson and @ErnestPasour ,
I actually had submitted an answer trying to clarify, but it seems to have failed...well, thanks for clarifying Mike. This is exactly what they are asking (GMP regulated Pharmacompany).
They thought of it to create a "play-only" version of a workflow, which they could distribute to users for routine use. Since they are in a regulated environment, they need to validate their processes, which (as Mike said already) includes stuff like writing Standard Operating Procedures (SOPs) where each step (of the validated process) is described.
This was something they had to do before JMP 17 already, so there are ways to make this happen without the additional feature, but it would be very nice to have for them.
In terms of wishlist, they told me there is already a similar entry in place. But I'll add it to the internal version as well!
Merry Christmas all!
Re: Locking a workflow for validated process (GMP)As a follow on question to this - does anybody know if there's a way to lock a JMP App (.jmpapp or .jmpappsource file)? I can't seem to find anything around that either.
M
Re: Locking a workflow for validated process (GMP)I talked about what I could implement last week and this is what I came up with.
1. The "package" command (from the red triangle) will have a checkbox on it for "Lock" or "Lock for Editing" or "Lock for Viewing" or something like that.
2. If a workflow is locked, then when it comes up the UI will be limited (can't see/change settings, inability to reorder steps). Probably remove ability to saveAs or duplicate or copy as those allow the restrictions to be trivially bypassed. But I'm interested in opinions on this.
3. If a workflow is locked, the UI could also be simplified more (ex. remove ability to backstep or skip steps). Maybe this is a separate option.
4. No way to unlock a workflow from the UI (but you could open the file outside of JMP and tweak it)
5. I would add a separate option if desired for attempting to hide information. Ex. don't show jsl code on hover over a step. But it still wouldn't be "security", just making it harder to casually tell what's happening.
Using the packaging mechanism means that the author won't be locked out of the workflow he just created, so it's kind of a natural flow. Not allowing a flow to be unlocked means that I don't have to worry about coming up with some password mechanism to determine if unlocking is okay.
@Florian_Vogt , @MikeD_Anderson , what feedback do you have on this direction?
Re: Locking a workflow for validated process (GMP)@ErnestPasour - I think that's a good middle ground for what we're after on this. @Florian_Vogt - what do you think?
Re: Locking a workflow for validated process (GMP)Sorry for replying late, I was absent for a bit.
I think this covers the need my client requested very well! Point 5 should not be critical (seeing whats happening is not generally a problem) - it is really more about ensuring nobody can change the way the workflow works (except the author/authorized people).
Thanks and best regards from Germany
Re: Locking a workflow for validated process (GMP)@Florian_Vogt, do you have feedback on what @ErnestPasour is proposing?
