---
title: SAIF.Application security and authorization
summary: Authorization requirements, enforcement points, and security contracts for SAIF.Application.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-07-24
library: SAIF.Application
reference_type: package
---

# SAIF.Application security and authorization

This page documents authorization mechanisms implemented or consumed by `SAIF.Application`. Authentication is infrastructure-provided; this library focuses on programmatic authorization checks, role assignment, and reusable access caching.

## Authorization architecture

`SAIF.Application` uses local programmatic checks that delegate resource authorization to `clsSecurityPrincipal`. `UserAccess` caches resource checks, while `AppManagerBase` exposes application-level accessibility flags derived from a single effective `AppSecurityRole` value.

```mermaid
flowchart TD
    Caller[Calling code] --> AppManager[AppManagerBase]
    Caller --> Access[UserAccess]
    AppManager --> Role[MarkUpdate / MarkViewOnly / MarkNoAccess]
    Access --> Principal[clsSecurityPrincipal]
    Principal --> Access
    Role --> Result[Accessibility flags]
```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| *(none documented as literals)* | Resource names are supplied by callers at runtime rather than defined in this library. | `UserAccess.HasAccess(...)`; `UserAccess.CheckAccess(...)` | `Application\SAIF.Application\UserAccess.vb` |

## Authorization enforcement points

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `UserAccess` | `HasAccess(inResourceName)` | Caller-supplied resource name | `IsAuthorized` | `Application\SAIF.Application\UserAccess.vb` |
| `UserAccess` | `CheckAccess(ParamArray inResourceName())` | Caller-supplied resource names | `HasAccess` | `Application\SAIF.Application\UserAccess.vb` |
| `AppManagerBase` | `SecurityRole`, `IsAccessible`, `IsUpdateable`, `IsViewOnly`, `IsRestricted` | `AppSecurityRole` (`ViewOnly`, `Update`, `NoAccess`) | Role state | `Application\SAIF.Application\AppManagerBase.vb` |
| `AppManagerBase` | `OnCheckSecurity()` | Role assignment through `MarkUpdate()`, `MarkViewOnly()`, `MarkNoAccess()` | Security hook | `Application\SAIF.Application\AppManagerBase.vb` |

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `clsSecurityPrincipal` | Framework security principal used for authorization decisions. | `UserAccess`; `AppManagerBase` | `Application\SAIF.Application\UserAccess.vb`; `Application\SAIF.Application\AppManagerBase.vb` |
| `UserAccess` | Library-local authorization cache wrapper over `clsSecurityPrincipal`. | Application-manager implementations and other callers that need reusable resource checks. | `Application\SAIF.Application\UserAccess.vb` |
| `AppManagerBase` | Base class that translates security decisions into library-visible accessibility state. | Concrete application-manager implementations in consuming applications. | `Application\SAIF.Application\AppManagerBase.vb` |

## Notes
- AD resource names listed here use runtime caller input rather than hard-coded string literals in this library.
- Role-state behavior aligns with [BR-001](business-rules.md#br-001-single-effective-application-security-role), and cached access behavior aligns with [BR-003](business-rules.md#br-003-authorization-results-are-cached-per-resource-name).

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [API reference](api/index.md)
- [Configuration](configuration.md)

## Sources
- `Application\SAIF.Application\AppManagerBase.vb`
- `Application\SAIF.Application\Enums.vb`
- `Application\SAIF.Application\UserAccess.vb`