---
title: Resolve and authorize the policy context
summary: Validates the requested policy number, retrieves policy data, and applies the application-layer access decision.
status: draft
owner: SAIF Documentation Generation
last_reviewed: 2026-07-31
library: SAIF.Application.Policy
reference_type: package
operation_id: OP-02
trigger: Caller invokes Retrieve() or changes the active policy context
---

# Resolve and authorize the policy context

This operation is the main application-layer gate for policy access. It validates the requested policy number, loads the underlying policy data, delegates policy-level authorization when applicable, and updates the manager's context and message state.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-02 |
| **Trigger** | Caller invokes `Retrieve()` or changes the active policy context |
| **Inputs** | Policy number, security principal, user access level |
| **Outputs** | Boolean success plus updated context, no-access flag, and user-facing message |
| **Primary components** | `PolicyAppManager.OnRetrieve`, `PolicyAppManager.UserCanAccessPolicy`, `PolicyAppManager.GetPolicyData` |
| **Entry point** | `Application\SAIF.Application.Policy\PolicyAppManager.vb` |

## Steps

1. Check whether `PolicyNumber` is zero.
   - If so, mark the context not set, set the message to `PolicyNotEntered`, and return `False` ([BR-103](../business-rules.md#br-103-missing-policy-number-returns-policynotentered)).
2. Load `PolicyData`; reuse the cached instance only when the cached policy number still matches the current context ([BR-104](../business-rules.md#br-104-policy-data-is-cached-per-policy-number)).
   - Build the delegated read through `clsPolicyData.GetPolicyData(DPI, PolicyNumber, UserAccessLevel)`.
   - > **Origin**: The underlying retrieval steps are implemented in [Retrieve policy header](../../saif-business-view-policy/operations/retrieve-policy-header.md) and executed on behalf of this operation.
3. If `PolicyData.IsValid` is false, mark the context not set, set the message to `PolicyNotFound`, and return `False` ([BR-105](../business-rules.md#br-105-invalid-policy-returns-policynotfound)).
4. Evaluate `UserCanAccessPolicy`.
   - If `HttpContext.Current Is Nothing`, return `True` immediately ([BR-106](../business-rules.md#br-106-policy-authorization-runs-only-in-web-context)).
   - Otherwise delegate to `SAIF.Business.View.Policy.clsPolicySecurity.IsPolicyValidForUser(PolicyData)`.
   - > **Origin**: The delegated authorization sequence is implemented in [Authorize a policy for the current user](../../saif-business-view-policy/operations/authorize-policy-for-user.md).
5. If access is denied, mark the context set, mark no access, set the message to `PolicyNotAuthorized`, and return `False` ([BR-107](../business-rules.md#br-107-unauthorized-policy-keeps-context-set)).
6. If access is allowed, mark the context set, mark update, clear the message, and return `True`.

## Process flow

The following diagram visualizes the retrieval and access-decision flow.

```mermaid
flowchart TD
    Start([Retrieve request]) --> Missing{Policy number is 0?}
    Missing -->|Yes| NotEntered([PolicyNotEntered])
    Missing -->|No| Load[Load PolicyData]
    Load --> Valid{PolicyData.IsValid?}
    Valid -->|No| NotFound([PolicyNotFound])
    Valid -->|Yes| Web{HttpContext exists?}
    Web -->|No| Allow[Allow access]
    Web -->|Yes| Auth[Delegate policy authorization]
    Auth --> Access{Authorized?}
    Access -->|No| Deny([Set context + no access])
    Access -->|Yes| Success([Mark context set])
```

## Failure and edge-case behavior
- The missing-policy-number branch runs before authorization so callers never see an access-denied message for missing input ([BR-103](../business-rules.md#br-103-missing-policy-number-returns-policynotentered)).
- Non-web hosts bypass delegated policy authorization entirely ([BR-106](../business-rules.md#br-106-policy-authorization-runs-only-in-web-context)).

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)
- [Configuration](../configuration.md)

## Sources
- `Application\SAIF.Application.Policy\PolicyAppManager.vb`
- `Business\SAIF.Business.View.Policy\clsPolicyData.vb`
- `Business\SAIF.Business.View.Policy\clsPolicySecurity.vb`