---
title: "SAIF.Business.Menu security and authorization"
summary: "Authorization requirements, enforcement points, and data-level access control."
status: draft
owner: SAIF documentation team
last_reviewed: 2026-08-17
library: SAIF.Business.Menu
reference_type: package
---

# SAIF.Business.Menu security and authorization

This page documents the authorization model implemented by `SAIF.Business.Menu`. The library does not use AD resource groups or a centralized security service; it authorizes menu visibility from Oracle data stored in `MENU_SECURITY`, `MENU_SECURITY_USER`, and `MENU_FAVORITE`. The library trusts the caller-supplied `MenuUser` identifier and expects upstream callers to render only the rows returned by the authorized-menu collection.*

## Authorization architecture

Authorization is entirely data-level and query-driven. `clsMenuAuthorizedItemCollection` executes the authoritative menu SQL, joins item-to-group rows to user-to-group rows, includes items with no security rows, and optionally unions the user's active favorites. Whether any `SECURITY_GROUP_TXT` values also correspond to AD groups elsewhere in the platform cannot be confirmed from this library alone.**

```mermaid
flowchart TD
    Caller[Calling layer] --> Menu[clsMenuAuthorizedItemCollection]
    Menu --> Sec[(MENU_SECURITY)]
    Menu --> User[(MENU_SECURITY_USER)]
    Menu --> Fav[(MENU_FAVORITE)]
    Menu --> Items[(MENU_ITEM / MENU_PAGE / lookups)]
```

## AD resource catalog

This library has no AD-resource catalog. Instead, it uses business-defined `SECURITY_GROUP_TXT` values stored in database tables.

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| N/A | Authorization uses data-level security groups in [MENU_SECURITY](database-tables.md#menusecurity) and [MENU_SECURITY_USER](database-tables.md#menusecurityuser) rather than AD group names. | `clsMenuAuthorizedItemCollection.Criteria.RetrieveSQL` | `SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb` |

## Authorization enforcement points

No attribute-based authorization checks were identified in this library.

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `clsMenuAuthorizedItemCollection.Criteria` | `RetrieveSQL` | Per-user menu visibility | Data-level SQL membership and favorite/public union | `SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb` |
| `clsMenuAuthorizedItemCollection.Criteria` | `RetrieveAllSQL` | All-users menu snapshot | Data-level SQL membership and public union | `SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb` |
| `clsMenuAuthorizedItemCollection` | `GetMenuAuthorizedItems` | Authorized menu entry point | Programmatic retrieval gate | `SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb` |
| `clsMenuAuthorizedItem` | `IsUnsecured` | Public-item flag | Flag-based authorization indicator | `SAIF.Business.Menu\clsMenuAuthorizedItem.vb` |
| `clsMenuAuthorizedItemCollection` | `SecuredAppItems` | Secured-only in-memory view | Programmatic in-memory filter | `SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb` |
| `clsMenuItem` | `SecurityGroups` | Per-item security-group assignments | Programmatic retrieval of authoritative item groups | `SAIF.Business.Menu\clsMenuItem.vb` |
| `clsMenuItem` | `IsValid` | Child security-group validity | Programmatic validation gate | `SAIF.Business.Menu\clsMenuItem.vb` |
| `clsMenuSecurityUserCollection` | `GetMenuSecurityUserForUser` | User group memberships | Programmatic retrieval intended to be authoritative, but the underlying `retrieveForUserSQL` statement's `:MenuUser` bind variable is never supplied by `BeforeRetrieve` — see [SQL-MENU-035](sql/SQL-MENU-035-retrieve-menu-security-users-for-user.md); this retrieval fails rather than authoritatively return the user's groups. | `SAIF.Business.Menu\clsMenuSecurityUserCollection.vb` |
| `clsMenuSecurityCollection` | `contains(inSecurityGroup)` | Duplicate group assignment check | Programmatic in-memory duplicate check | `SAIF.Business.Menu\clsMenuSecurityCollection.vb` |

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Menu-item security assignment | `clsMenuSecurity` | Stores group assignments in [MENU_SECURITY](database-tables.md#menusecurity). Related rule: [BR-MENU-003](business-rules.md#br-menu-003-security-group-matching-is-case-insensitive). | `SAIF.Business.Menu\clsMenuSecurity.vb` |
| Menu-item security collection | `clsMenuSecurityCollection.GetMenuSecuritiesForItem` | Retrieves item-to-group rows from [MENU_SECURITY](database-tables.md#menusecurity) for maintenance and save cascades. Related rule: [BR-MENU-005](business-rules.md#br-menu-005-menu-item-validity-and-dirtiness-cascade-to-security-groups). | `SAIF.Business.Menu\clsMenuSecurityCollection.vb` |
| User security membership | `clsMenuSecurityUser` | Stores user-to-group rows in [MENU_SECURITY_USER](database-tables.md#menusecurityuser). Related rule: [BR-MENU-003](business-rules.md#br-menu-003-security-group-matching-is-case-insensitive). | `SAIF.Business.Menu\clsMenuSecurityUser.vb` |
| User security collection | `clsMenuSecurityUserCollection.GetMenuSecurityUserForUser` | Intended to retrieve a user's memberships from [MENU_SECURITY_USER](database-tables.md#menusecurityuser), but the `:MenuUser` bind variable in the underlying [SQL-MENU-035](sql/SQL-MENU-035-retrieve-menu-security-users-for-user.md) statement is not supplied by the code, so this retrieval path fails rather than authorize on the intended per-user data. Related rule: [BR-MENU-003](business-rules.md#br-menu-003-security-group-matching-is-case-insensitive). | `SAIF.Business.Menu\clsMenuSecurityUserCollection.vb` |
| Effective authorization join | `clsMenuAuthorizedItemCollection.Criteria.RetrieveSQL` | Joins [MENU_SECURITY](database-tables.md#menusecurity) and [MENU_SECURITY_USER](database-tables.md#menusecurityuser), returns public items under [BR-MENU-002](business-rules.md#br-menu-002-unsecured-menu-items-are-visible-by-default), and unions favorites under [BR-MENU-004](business-rules.md#br-menu-004-favorites-are-always-included-and-ordered). | `SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb` |
| All-users public snapshot | `clsMenuAuthorizedItemCollection.Criteria.RetrieveAllSQL` | Emits the `UNSECURED` sentinel used by [BR-MENU-006](business-rules.md#br-menu-006-retrieve-all-uses-the-unsecured-wildcard-sentinel). | `SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb` |

## Segregation of duties

SoD is not a feature of this library. The CRUD factories for `clsMenuSecurity` and `clsMenuSecurityUser` do not embed a separate administrator-role gate, so any restriction on who may administer menu security must exist in calling layers or database grants outside this library.*

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `clsMenuAuthorizedItemCollection` | Executes the authoritative menu-authorization query and materializes projection rows. | Calling layers that need authorized navigation. | `SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb` |
| `clsMenuSecurityCollection` | Persists and retrieves item-to-group assignments. | `clsMenuItem` maintenance flows. | `SAIF.Business.Menu\clsMenuSecurityCollection.vb` |
| `clsMenuSecurityUserCollection` | Persists and retrieves user-to-group memberships. | Administrative maintenance flows. | `SAIF.Business.Menu\clsMenuSecurityUserCollection.vb` |

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `SAIF.Business.Menu\clsMenuAuthorizedItem.vb`
- `SAIF.Business.Menu\clsMenuAuthorizedItemCollection.vb`
- `SAIF.Business.Menu\clsMenuItem.vb`
- `SAIF.Business.Menu\clsMenuSecurity.vb`
- `SAIF.Business.Menu\clsMenuSecurityCollection.vb`
- `SAIF.Business.Menu\clsMenuSecurityUser.vb`
- `SAIF.Business.Menu\clsMenuSecurityUserCollection.vb`
- `SAIF.Business.Menu\mdlUtilities.vb`