---
title: SAIF.Application.Policy operations and processes
summary: Business and technical operations supported by the policy application layer.
status: draft
owner: SAIF Documentation Generation
last_reviewed: 2026-07-31
library: SAIF.Application.Policy
reference_type: package
---

# SAIF.Application.Policy operations and processes

This page is the operation catalog and cross-operation hub for `SAIF.Application.Policy`. Each operation's step-by-step logic lives in its own page under `operations/`.

## Operation catalog
| Operation | Intent | Trigger | Inputs | Outputs | Rules | Tables | SQL |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [Establish the policy data layer](operations/establish-the-policy-data-layer.md) | Create the policy portal and fixed database identity | Manager initialization | Security principal, portal configuration | Initialized portal and `DPI` | [BR-101](business-rules.md#br-101-fixed-gen-database-user), [BR-102](business-rules.md#br-102-failed-portal-creation-revokes-context-and-access) | — | — |
| [Resolve and authorize the policy context](operations/resolve-and-authorize-the-policy-context.md) | Validate the policy number, load policy data, and apply access decisions | `Retrieve()` or context change | Policy number, security principal, user access level | Updated manager context, access state, and message | [BR-103](business-rules.md#br-103-missing-policy-number-returns-policynotentered), [BR-104](business-rules.md#br-104-policy-data-is-cached-per-policy-number), [BR-105](business-rules.md#br-105-invalid-policy-returns-policynotfound), [BR-106](business-rules.md#br-106-policy-authorization-runs-only-in-web-context), [BR-107](business-rules.md#br-107-unauthorized-policy-keeps-context-set) | — | — |
| [Determine Business Online access](operations/determine-business-online-access.md) | Resolve external-account access and last-logon text | First read of Business Online properties | Policy number, policy validity, environment state | Access flag, last-logon date, rendered access text | [BR-108](business-rules.md#br-108-business-online-access-comes-from-external-accounts), [BR-109](business-rules.md#br-109-business-online-text-is-internal-only) | — | — |
| [Build the policy header settings](operations/build-the-policy-header-settings.md) | Construct header settings and default visibility flags | First read of `PolicyHeaderSettings` | `DPI`, security principal, selected association type | Initialized `IPolicyHeaderSettings` | [BR-110](business-rules.md#br-110-only-default-header-association-types-are-candidates), [BR-111](business-rules.md#br-111-test-information-is-hidden-in-production), [BR-117](business-rules.md#br-117-default-association-type-is-lowest-sort-order) | — | — |
| [Determine visible association types](operations/determine-visible-association-types.md) | Compute which association types the current principal may see | Header settings or provider needs validated types | `DPI`, security principal | Authorized association-type set | [BR-112](business-rules.md#br-112-secured-association-types-require-matching-resource) | — | — |
| [Filter associations and select the default](operations/filter-associations-and-select-the-default.md) | Apply ownership filters and choose the selected association type | Header associations are loaded or default selection is needed | Policy-header associations, security principal | Filtered associations or unknown-type fallback | [BR-113](business-rules.md#br-113-association-filtering-applies-only-to-policyholders-and-agents), [BR-114](business-rules.md#br-114-non-numeric-user-number-fails-closed), [BR-115](business-rules.md#br-115-policyholders-see-only-their-parented-association-types), [BR-116](business-rules.md#br-116-agents-see-only-their-own-agent-or-agency-associations), [BR-117](business-rules.md#br-117-default-association-type-is-lowest-sort-order) | — | — |
| [Assemble the policy header payload](operations/assemble-the-policy-header-payload.md) | Compose the rendered policy-header values, messages, help text, and cancellation status | A consumer reads header-provider members | `DPI`, policy number, security principal, optional target association types | Fully composed header data | [BR-112](business-rules.md#br-112-secured-association-types-require-matching-resource), [BR-116](business-rules.md#br-116-agents-see-only-their-own-agent-or-agency-associations), [BR-118](business-rules.md#br-118-demo-mode-masks-policyholder-values), [BR-119](business-rules.md#br-119-coverage-bound-indicator-requires-bound-status-and-period), [BR-120](business-rules.md#br-120-cancellation-status-is-for-saif-employees-only), [BR-121](business-rules.md#br-121-null-cancellation-status-becomes-empty), [BR-122](business-rules.md#br-122-rate-account-comes-from-er-combination-parent), [BR-123](business-rules.md#br-123-relationship-description-uses-parent-type-and-policy-number), [BR-124](business-rules.md#br-124-other-states-coverage-emits-a-header-message), [BR-125](business-rules.md#br-125-help-text-uses-the-polhd-application-code) | [POLICY](database-tables.md#policy), [POLICY_STATUS_CODE](database-tables.md#policy_status_code), [POLICY_DEMAND](database-tables.md#policy_demand), [POLICY_PERIOD_PAYROLL_AUDIT](database-tables.md#policy_period_payroll_audit), [AUDIT_CODE](database-tables.md#audit_code), [CANCELLATION](database-tables.md#cancellation), [COLLECTION_LEGAL_ACTION](database-tables.md#collection_legal_action) | [SQL-001](sql/SQL-001-cancellation-status-derivation.md) |
| [Classify principal roles](operations/classify-principal-roles.md) | Derive policy-facing role flags from authorization resources and domain | First read of `Security` or any role flag | Security principal | Cached role decisions | [BR-126](business-rules.md#br-126-agent-status-comes-from-three-resource-paths), [BR-127](business-rules.md#br-127-saif-employee-status-comes-from-domain) | — | — |
| [Manage the transaction envelope](operations/manage-the-transaction-envelope.md) | Guard begin/commit/rollback behavior for the policy portal | Transaction start or stop request | Portal transaction state, commit flag | Idempotent transaction boundary behavior | [BR-128](business-rules.md#br-128-the-manager-never-writes) | — | — |

## Process flow diagram
The following diagram visualizes the primary application-layer flow across policy retrieval and header composition.

```mermaid
flowchart TD
    Start([Policy request]) --> Init[Establish the policy data layer]
    Init --> Resolve[Resolve and authorize the policy context]
    Resolve --> Access{Context valid and allowed?}
    Access -->|No| Deny([Return message and access state])
    Access -->|Yes| Settings[Build the policy header settings]
    Settings --> Types[Determine visible association types]
    Types --> Assoc[Filter associations and select the default]
    Assoc --> Header[Assemble the policy header payload]
    Resolve --> BO[Determine Business Online access]
    Resolve --> Roles[Classify principal roles]
    Header --> Done([Return application-layer policy view])
    BO --> Done
    Roles --> Done
```

## Database interactions
The following table summarizes the operation that directly touches database logic owned by this library. Delegated reads inside referenced libraries are described in the operation detail pages.

| Operation | SQL | Tables | Type |
| --- | --- | --- | --- |
| [Assemble the policy header payload](operations/assemble-the-policy-header-payload.md) | [SQL-001](sql/SQL-001-cancellation-status-derivation.md) | [POLICY](database-tables.md#policy), [POLICY_STATUS_CODE](database-tables.md#policy_status_code), [POLICY_DEMAND](database-tables.md#policy_demand), [POLICY_PERIOD_PAYROLL_AUDIT](database-tables.md#policy_period_payroll_audit), [AUDIT_CODE](database-tables.md#audit_code), [CANCELLATION](database-tables.md#cancellation), [COLLECTION_LEGAL_ACTION](database-tables.md#collection_legal_action) | Read |

## Failure and edge-case behavior
- Missing policy numbers and invalid policies fail before authorization evaluation.
- Unauthorized policies keep the context set but mark no access so callers can distinguish denial from not-found behavior.
- Non-web hosts bypass policy-level authorization because `UserCanAccessPolicy` returns `True` when `HttpContext.Current Is Nothing`.**
- Shared authorization caches and user-number caches persist for the process lifetime unless the host recycles.*

## Stored procedure operations
Operations implemented in Oracle function logic referenced by this library.

| Operation | Description | Source | Link |
| --- | --- | --- | --- |
| PROC-OP-01 | Load policy status context | `SP72268_GET_CANCEL_STATUS` | [Details](procedures/sp72268-get-cancel-status.md#operations) |
| PROC-OP-02 | Derive pending-cancel status | `SP72268_GET_CANCEL_STATUS.pending_cancel_status` | [Details](procedures/sp72268-get-cancel-status.md#operations) |
| PROC-OP-03 | Derive cancelled-policy status | `SP72268_GET_CANCEL_STATUS.cancel_status` | [Details](procedures/sp72268-get-cancel-status.md#operations) |
| PROC-OP-04 | Derive saifQuote status for applications | `SP72268_GET_CANCEL_STATUS.saifquote_status` | [Details](procedures/sp72268-get-cancel-status.md#operations) |
| PROC-OP-05 | Return derived status to the caller | `SP72268_GET_CANCEL_STATUS` | [Details](procedures/sp72268-get-cancel-status.md#operations) |

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with `**` could not be confirmed; treat as unknown until verified.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [Configuration](configuration.md)
- [API reference](api/index.md)

## Sources
- `Application\SAIF.Application.Policy\PolicyAppManager.vb`
- `Application\SAIF.Application.Policy\clsPolicySecurity.vb`
- `Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb`
- `Application\SAIF.Application.Policy\PolicyHeader\clsStandardPolicyHeaderDataProvider.vb`
- `Application\SAIF.Application.Policy\PolicyHeader\clsStandardPolicyHeaderSettings.vb`