---
title: SAIF.Application.Claim security and authorization
summary: Authorization controls for SAIF.Application.Claim.
status: draft
owner: Technical Writer
last_reviewed: 2026-07-28
library: SAIF.Application.Claim
reference_type: package
---

# SAIF.Application.Claim security and authorization

This page documents the authorization patterns implemented by `SAIF.Application.Claim`.

## Authorization architecture

Claim authorization is evaluated locally through `ClaimUserAccess`, `ClaimSecurity`, and the base application manager before application-specific retrieval continues.

```mermaid
flowchart TD
    Caller[Calling code] --> AppMgr[ClaimAppManager]
    AppMgr --> Access[ClaimUserAccess]
    AppMgr --> Security[ClaimSecurity]
    Security --> Claim[Claim data]
    AppMgr --> Override[ClaimServices override check]
```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `SecureClaim` | Determines access to hostile or secure claims. | `ClaimUserAccess.SecureClaimAccess` | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |
| `ConflictClaim` | Determines access to worker-conflict claims. | `ClaimUserAccess.ConflictAccess` | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |
| `ExposureClaim` | Determines access to exposure claims. | `ClaimUserAccess.ExposureAccess` | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |
| `CollateralHealthClaim` | Defines the named health-issue resource exposed by `ClaimUserAccess`. | `ClaimUserAccess.HealthIssueAccess` | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |

## Authorization enforcement points

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `ClaimUserAccess` | `SecureClaimAccess` | `SecureClaim` | `HasAccess` | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |
| `ClaimUserAccess` | `ConflictAccess` | `ConflictClaim` | `HasAccess` | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |
| `ClaimUserAccess` | `ExposureAccess` | `ExposureClaim` | `HasAccess` | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |
| `ClaimUserAccess` | `HealthIssueAccess` | `CollateralHealthClaim` | `HasAccess` | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |
| `ClaimUserAccess` | `New(clsSecurityPrincipal, ParamArray AccessRights())` | `Caller-supplied resource names` | `CheckAccess` | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |
| `ClaimSecurity` | `CheckClaim(clsClaimData)` | `ConflictClaim`, `ExposureClaim`, `SecureClaim` | `Composite claim-scope evaluation` | `Application\SAIF.Application.Claim\ClaimSecurity.vb` |
| `ClaimAppManager` | `CheckForSecurityOverride()` | `Claim-specific override` | `ClaimServices.HasOverrideAcess` | `Application\SAIF.Application.Claim\ClaimAppManager.vb` |

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Claim | `ClaimSecurity.CheckClaim(clsClaimData)` | Evaluates claim flags (`IsWorkerConflict`, `IsExposure`, `IsHealthIssue`, `IsHostileWorker`) against the current user's cached AD-resource access to derive per-claim access outcomes. | `Application\SAIF.Application.Claim\ClaimSecurity.vb` |
| Claim override | `ClaimAppManager.CheckForSecurityOverride()` → `ClaimServices.HasOverrideAcess(...)` | Runs the SQL-backed exception check against `CL_SECURITY_OVERRIDE` joined to `ADP_VIRTUAL_EMPLOYEE_VIEW`, filtered by `ClaimID`, `USER_ID`, and effective date range. | `Application\SAIF.Application.Claim\ClaimAppManager.vb`; `Business\SAIF.Business\ClaimServices.vb` |

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `ClaimUserAccess` | Wraps claim-domain AD-resource checks. | `ClaimSecurity`, consuming application managers | `Application\SAIF.Application.Claim\ClaimUserAccess.vb` |
| `ClaimSecurity` | Computes claim-specific access outcomes. | `ClaimAppManager` | `Application\SAIF.Application.Claim\ClaimSecurity.vb` |

## Inherited security

### From `UserAccess` (`SAIF.Application`)

| Field | Value |
| --- | --- |
| **Mechanism** | `ClaimUserAccess` inherits `UserAccess.HasAccess`, which caches per-resource decisions and delegates uncached checks to `clsSecurityPrincipal.IsAuthorized`. |
| **Enforcement** | Claim-specific properties wrap `HasAccess` for the four claim-domain resource names. |
| **Origin** | `SAIF.Application` — `UserAccess` |
| **Source** | `Application\SAIF.Application.Claim\ClaimUserAccess.vb`; `Application\SAIF.Application\UserAccess.vb` |

## Notes
- AD resource names are documented without environment suffixes.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [API reference](api/index.md)

## Sources
- `Application\SAIF.Application.Claim\ClaimAppManager.vb`
- `Application\SAIF.Application.Claim\ClaimSecurity.vb`
- `Application\SAIF.Application.Claim\ClaimUserAccess.vb`
- `Application\SAIF.Application\UserAccess.vb`
- `Business\SAIF.Business\ClaimServices.vb`