Question:

Is there a limitation on an SDK user object record trigger in Vault?

Answer:

Yes, Vault prevents an SDK object record trigger on the objects listed below.  They are related to user security.

• user__sys
• user_role_setup__v
  
• security_policy__sys
• security_profile__sys
• permission_set__sys

Related Documentation:

Vault Help Documentation: Vault SDK Record Triggers