---
title: clsPolicySecurity
summary: API reference for clsPolicySecurity.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-07-31
library: SAIF.Business.View.Policy
reference_type: package
---

# clsPolicySecurity

`clsPolicySecurity` is the library's only authorization class. Constructed with a security principal and a data portal, it answers two questions: whether a given policy is visible to that principal, and which policies the principal may see at all. Both answers are fail-closed — the decision starts at refuse and the list starts empty — and both branch on the principal's user type. Its checks reach two different data stores: the Oracle policy store for agent, policyholder, and auditor questions, and a separate SQL Server store, configured from the `BDS_*` settings, for group membership.

## Purpose

- Refuses a secure SAIF policy to any principal lacking the `SAIFpolicyInfo` Active Directory resource ([BR-001](../../business-rules.md#br-001-secure-saif-policies-require-explicit-authorization)).
- Applies the per-user-type access decision for agents, policyholders, groups, loss-control consultants, and auditors ([Authorize a policy for the current user](../../operations/authorize-policy-for-user.md)).
- Builds the permitted policy list for the principal, using a different scope query per user type ([Build the permitted policy list](../../operations/build-permitted-policy-list.md)).
- Translates a framework user type into the ranked access level the rest of the library consumes ([BR-013](../../business-rules.md#br-013-user-type-maps-to-a-ranked-access-level)).

## Context

- Namespace: `SAIF.Business.View.Policy`
- Assembly/package: `SAIF.BOF.Business.View.Policy`
- Declared in: `Business/SAIF.Business.View.Policy/clsPolicySecurity.vb`

## Public members

| Member | Signature | Purpose |
| --- | --- | --- |
| UserType | `Public ReadOnly Property UserType() As clsUserType` | The framework classification of the current principal, on which every access branch turns. |
| UserAccessLevel | `Public ReadOnly Property UserAccessLevel() As clsPolicyData.UserAccessLevels` | The ranked visibility level derived from the principal's user type ([BR-013](../../business-rules.md#br-013-user-type-maps-to-a-ranked-access-level)). |
| SecurityPrincipal | `Public ReadOnly Property SecurityPrincipal() As clsSecurityPrincipal` | The principal whose access this instance evaluates. |
| PolicyList | `Public ReadOnly Property PolicyList() As List(Of strPolicyList)` | The policies this principal may see, built by the scope query matching the principal's user type and empty when none matches ([Build the permitted policy list](../../operations/build-permitted-policy-list.md)). |
| New | `Public Sub New(ByVal inSecurityPrincipal As clsSecurityPrincipal, ByVal inDPI As IDataPortalInfo)` | Binds the evaluator to a principal and an Oracle data portal; the SQL Server portal is initialised separately from configuration.* |
| IsPolicyValidForParentPolicy | `Public Function IsPolicyValidForParentPolicy(ByVal inPolicyNum As Decimal) As Boolean` | Decides whether a policyholder may see a policy by ownership or by a shared parent association ([BR-005](../../business-rules.md#br-005-policyholders-see-their-own-policy-and-policies-under-the-same-parent-association)). |
| IsPolicyValidForUser | `Public Function IsPolicyValidForUser(ByRef inPolicyData As clsPolicyData) As Boolean` | Decides whether the principal may see an already loaded policy, refusing secure policies without the Active Directory resource and unmatched user types ([BR-001](../../business-rules.md#br-001-secure-saif-policies-require-explicit-authorization), [BR-019](../../business-rules.md#br-019-policy-lists-fail-closed)). |
| IsPolicyValidForUser | `Public Function IsPolicyValidForUser(ByVal inPolicyNum As Decimal) As Boolean` | Loads the policy by number and then decides whether the principal may see it ([Authorize a policy for the current user](../../operations/authorize-policy-for-user.md)). |
| ConvertUserTypeToUserAccessLevel | `Public Shared Function ConvertUserTypeToUserAccessLevel(ByVal inUserType As clsUserType) As clsPolicyData.UserAccessLevels` | Maps a framework user type onto the ranked access level the rest of the library consumes, doubling every external type into a demonstration variant ([BR-013](../../business-rules.md#br-013-user-type-maps-to-a-ranked-access-level)). |

## Behavioral notes

- The class initialises its second data portal lazily on first use, reading the three `BDS_*` settings described on the [Configuration](../../configuration.md) page.*
- The loss-control check truncates the assignment name at a `%` wildcard before comparing, so a stored wildcard pattern behaves as a prefix ([BR-007](../../business-rules.md#br-007-loss-control-consultants-see-only-policies-they-are-assigned-to)).

## Constraints and usage notes

- Every decision path that finds no matching user type refuses access or returns an empty list ([BR-019](../../business-rules.md#br-019-policy-lists-fail-closed)).
- A misconfigured BDS connection cannot be distinguished from a negative group-membership answer; both refuse access.*

> **Note:** Statements marked with `†` are derived from dependency library
> documentation via the Legends CLI. Statements marked with `*` were inferred
> from code structure or contextual evidence. Statements marked with `**` could
> not be confirmed; treat as unknown until verified.

## Sources

- `Business/SAIF.Business.View.Policy/clsPolicySecurity.vb`