Configure scoped sessions

Scoped sessions require a user to pick a subset of predefined Markings to access during their Foundry session to create a visual separation between different types of work. Scoped sessions function across both the Foundry file system and ontology workspaces.

Scoped sessions can reduce the chances of accidental cross-pollination of work across different purposes in Foundry. For example, a user working on a particular healthcare research project may be prohibited from using information in another healthcare research project (even though they may have access), since the intermingling of data could compromise the validity of their research. By requiring users to explicitly select their working scope at login, the risk of cross-pollination is reduced and the user can work with greater confidence.

An administrator can configure scoped sessions for your Organization from within Control Panel. Scoped sessions should be configured carefully since they can affect all users who log into Foundry and may potentially lead to the display of a Foundry workspace banner. For this reason, scoped sessions are disabled by default.

To enable scoped sessions for your Organization, we recommend following these high-level steps:

1. Review your Marking setup
2. Create scoped sessions
3. Review scoped sessions settings

Review your Marking setup

Scoped sessions restrict access based on a user's Marking membership. Therefore, to restrict a user's scope throughout the platform, you must both:

• Have the correct users as members of the correct Markings, and
• Have Markings applied to projects, folder, or files in the way you want to focus a user's access in Foundry.

For example, assume Anya Kimball is a user who should only work on a specific research project at a given time and not see any other research projects. This is a good use case for using scoped sessions. To begin setting up scoped sessions, first ensure that Anya is a member of the correct set of research Markings.

Then you would confirm that the research Markings are applied correctly throughout the Foundry platform. Users will be able to see anything that has one or more of the Markings included in the scoped session. Also, users will be able to see anything that does not have a Marking.

Create scoped sessions

To create a scoped session, open the Scoped sessions settings for your Organization from the side panel in Control Panel. Select New scoped session, then complete the form that appears. After creation, you can edit the same set of details available during the creation process.

Only users who are members of all the Markings selected in the scoped session will be able to choose this scoped session. In this example, Anya is a member of all required research-related Markings, so she will be able to select from all available scoped sessions when she logs into Foundry.

You can change the Markings for a given scoped session by selecting Manage in the right-side panel. You can also delete a scoped session with the Delete scoped session button.

Review scoped sessions settings

Before enabling scoped sessions, consider the following configuration questions:

• Do you want users to always see the scoped session selector at login?
• Do you want to allow users to have unscoped marking access?
• Do you want to allow users to scope their group access?

Show scoped session selector at login

Use the guidelines below when configuring the scoped session selector:

• When configured as Off to denote that the scoped sessions marking selector is not required at login, users will automatically log in with unscoped marking access.

• When configured as Auto - skip the selector when only one option is available, users will only see the scoped session selector at login when they have access to more than one scoped session.

• When configured to Always show selector, users will always see the scoped session selector when logging in, even if only one session is available to them.

Allow unscoped marking access

Even when the scoped sessions marking selector is shown, a user may be granted permission to continue with unscoped marking access. You can enable unscoped marking access for all users in your Organization, for members of select groups only, or for all users except members of selected groups. This provides more control over who can bypass scoped sessions. Typically, administrators or support users should be allowed to have unscoped marking access.

Allow scoped group access

In addition to being able to scope their marking access, users can also scope their group access. This is useful for users who are members of multiple groups and want to limit their access to a subset of their groups for testing purposes. By default, all users can scope their group access, but you can restrict this to specific groups, if needed.

Review the emulation mode documentation to learn more about scoping group and marking access to help when testing workflows in the platform.

Example usage

To continue with our example of Anya from above, after scoped sessions are configured, Anya would see the dialog below when she logs into Foundry.

After selecting the SARS-CoV-2 B.1.1.529 Genome mapping scoped session, Anya would only have access to projects, folders, and files that have no Markings on them or have either the B.1.1.529 and/or SARS-CoV-2 Markings on them.

More details about scoped sessions from a user's perspective can be found in the Markings documentation.