---
title: clsPolicySecurity
summary: API reference for clsPolicySecurity.
status: draft
owner: SAIF Documentation Generation
last_reviewed: 2026-07-31
library: SAIF.Application.Policy
reference_type: package
---

# clsPolicySecurity

`clsPolicySecurity` classifies the current principal into the policy-facing role flags used by `PolicyAppManager` and the policy-header subsystem. It is the library's local role gate, distinct from the view-layer component that decides whether the user may access a specific policy.

## Purpose
- Translate authorization-resource membership into role flags such as agent, producer, auditor, demo, group, and policyholder.
- Provide a stable, cached role-classification surface for the rest of the application layer.

## Context
- Namespace: `SAIF.Application.Policy`
- Assembly/package: `SAIF.Application.Policy`

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `New` | `Sub New(ByVal inSecurityPrincipal As clsSecurityPrincipal)` | Captures the principal whose role flags will be evaluated and cached. |
| `UserID` | `ReadOnly Property UserID() As String` | Exposes the identifier used by downstream policy logic to recognize the current principal. |
| `SecurityPrincipal` | `ReadOnly Property SecurityPrincipal() As clsSecurityPrincipal` | Exposes the `clsSecurityPrincipal` whose `IsAuthorized` and domain checks back every cached role decision in this type. |
| `IsAgent` | `ReadOnly Property IsAgent() As Boolean` | Checks `AgencyExternal`, `ProducerExternal`, and `ARPAgencyExternal`; a true result routes the caller through the agent ownership filter that limits visible header associations to rows matching the user's `AgentNumber` or `AgencySeqNum`. |
| `IsProducer` | `ReadOnly Property IsProducer() As Boolean` | Checks `ProducerExternal`; producer membership also satisfies `IsAgent`, so the user receives the same agent-scoped header-association filtering downstream. |
| `IsAuditorUser` | `ReadOnly Property IsAuditorUser() As Boolean` | Checks `AuditorExternal` and exposes the fee-auditor classification to policy consumers; no additional local authorization branch consumes this flag in the compiled assembly. |
| `IsDemoUser` | `ReadOnly Property IsDemoUser() As Boolean` | Checks `BusinessOnlineDemo`, the demo-user classification the header stack uses to replace real agency and policyholder identifiers with fixed masking text. |
| `IsGroupUser` | `ReadOnly Property IsGroupUser() As Boolean` | Checks `GroupsOnlineExternal` and exposes the group-user classification to policy consumers; no additional local authorization branch consumes this flag in the compiled assembly. |
| `IsLossControlUser` | `ReadOnly Property IsLossControlUser() As Boolean` | Checks `LossControlExternal` and exposes the loss-control classification to policy consumers; no additional local authorization branch consumes this flag in the compiled assembly. |
| `IsPolicyHolder` | `ReadOnly Property IsPolicyHolder() As Boolean` | Checks `DivPolicyholderExternal`; a true result routes header associations through policyholder ownership filtering so only parented association types for that user's policy number remain visible. |
| `IsQuickFileUser` | `ReadOnly Property IsQuickFileUser() As Boolean` | Checks `PolicyPayrollQuickFileExternal` and exposes the quick-file classification to policy consumers; no additional local authorization branch consumes this flag in the compiled assembly. |
| `IsSAIFEmployee` | `ReadOnly Property IsSAIFEmployee() As Boolean` | Treats the `SAIF` domain as the internal-user role, matching the downstream split that keeps cancellation-status text internal and switches secured association-type checks between internal resource names and `<group>Ext` names. |

## Behavioral notes
- Each role property computes once and then returns a cached nullable-Boolean result.
- `IsAgent` is inclusive and can be satisfied through direct agency access, producer access, or ARP agency access.

## Constraints and usage notes
- This class answers what kind of user the principal is; it does not answer whether the user may access a specific policy.

## Sources
- `Application\SAIF.Application.Policy\clsPolicySecurity.vb`