---
title: SAIF.Business.View.Policy overview
summary: High-level purpose, scope, and responsibilities for this library.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-07-31
library: SAIF.Business.View.Policy
reference_type: package
---

# SAIF.Business.View.Policy overview

> **Documentation context:** Packaged Component (NuGet)

SAIF.Business.View.Policy is the read side of the policy domain. It assembles a policy header and everything that hangs off it — agency, addresses, policy periods, staff assignments, trading-as names, affiliated policies, and policy-to-policy associations — into aggregates that claim-facing and policy-facing applications can consume without writing SQL. It also owns the decision about whether the signed-in principal is allowed to see a given policy at all. The library has no write path: every type is retrieved through a shared factory method and is read-only thereafter.

## Purpose

- Provide read-optimised policy aggregates to consuming applications, composing child objects lazily so that a caller pays only for the parts of a policy it touches.
- Decide, for the current security principal, whether a policy may be viewed and which policies make up that principal's permitted list.
- Ship as the `SAIF.BOF.Business.View.Policy` NuGet package, consumed by application and orchestration layers such as `SAIF.Application.Policy`.

## Responsibilities

- Retrieve the policy header and its lazily loaded detail, including waiver existence ([Retrieve policy header](operations/retrieve-policy-header.md), [Lazy-load policy detail](operations/lazy-load-policy-detail.md)).
- Resolve policy-to-policy associations through two coexisting subsystems: the legacy inline-SQL association list and the newer, code-table-driven association type model ([Resolve policy associations](operations/resolve-policy-associations.md), [Resolve policy-header associations](operations/resolve-policy-header-associations.md)).
- Apply data-level policy authorization for every external audience — agents, policyholders, groups, loss-control consultants, and auditors ([Authorize a policy for the current user](operations/authorize-policy-for-user.md), [Build the permitted policy list](operations/build-permitted-policy-list.md)).
- Supply the supporting aggregates a policy view needs: agency and agent contact, addresses, policy periods, team assignments, trading-as names, and non-employer accounts ([Retrieve supporting policy aggregates](operations/retrieve-supporting-policy-aggregates.md)).
- Mask policy, agency, and address detail for demonstration accounts, so masking cannot be bypassed by reading an aggregate directly ([BR-013](business-rules.md#br-013-user-type-maps-to-a-ranked-access-level)).

## Key components

- `clsPolicyData`: the central read-only policy header aggregate and the entry point for nearly every read in the library.
- `clsPolicySecurity`: the only authorization class; owns the per-policy access decision and the permitted policy list.
- `clsAgency`, `clsPolicyAddress`, `clsPolicyPeriod(Collection)`, `clsTeamAssignment(Collection)`, `clsTradingAs(Collection)`, `clsNonEmployerAccount`: independent read-only supporting aggregates.
- `PolicyAssociationList` and `PolicyAssociationExtensions`: the legacy inline-SQL association subsystem.
- `clsAssociationTypeCode`, `clsAssociationTypeFactory`, `clsPolicyHeaderAssociationFactory`: the code-table-driven association subsystem that supersedes it.
- `PolicyStatusEnums`, `AssociationTypes`, `clsPolicyData.UserAccessLevels`: the vocabularies consumers compare against instead of raw codes.

## Scope notes

- Configuration is minimal but architecturally significant: three settings configure a second, non-Oracle SQL Server data store used by the authorization path. See [Configuration](configuration.md).
- Six `.vb` files in the project folder are excluded from the `<Compile>` item group and are not part of the shipped assembly: `clsMCOCollection.vb`, `clsPolicyMCO.vb`, `clsPolicyMCOCollection.vb`, `clsPayrollClassInfo.vb`, `clsPayrollClassInfoCollection.vb`, and `clsPolicySearch.vb`. They are not documented as part of the public API surface.
- The `Institutions` typed dataset is generated from `Institutions.xsd` and has no call site in this library.**

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Related documentation

- [Index](index.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [Procedures](procedures/index.md)
- [API reference](api/index.md)

## Sources

- `Business/SAIF.Business.View.Policy/SAIF.BOF.Business.View.Policy.vbproj`
- `Business/SAIF.Business.View.Policy/SAIF.BOF.Business.View.Policy.nuspec`
- `Business/SAIF.Business.View.Policy/clsPolicyData.vb`
- `Business/SAIF.Business.View.Policy/clsPolicySecurity.vb`