---
title: Resolve policy header
summary: Reuses the session policy header or requests a new one for the selected policy.
status: draft
owner: SAIF IT Core Services
last_reviewed: 2026-10-12
library: BolMiddleware
reference_type: package
operation_id: OP-11
trigger: TryGetPolicyHeader during policy page handling
---

# Resolve policy header

This operation avoids repeated header calls by reusing the header stored in the session when it belongs to the requested policy. It also gates the header behind the policy access check.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-11 |
| **Trigger** | `TryGetPolicyHeader` during policy page handling |
| **Inputs** | Policy number, session, current user |
| **Outputs** | `Header` stored in the session, `AccessAllowed`, `ErrorMessage` |
| **Primary components** | `BolPolicyModel.TryGetPolicyHeader`, `BolPolicyModel.GetPolicyHeader`, `SecurityService.IsValidPolicyForCurrentUser` |
| **Entry point** | `src/BolMiddleware/Models/BolPolicyModel.cs` |

## Steps

1. Read the policy header from the session.
2. If its policy number equals the context policy number, use it and stop ([BR-BOLMIDDLEWARE-014](../business-rules.md#br-bolmiddleware-014-session-policy-header-reuse)).
3. Otherwise validate that the current user may see the policy ([BR-BOLMIDDLEWARE-009](../business-rules.md#br-bolmiddleware-009-policy-access-validation)); see [Authorization helpers](authorization-helpers.md).
   - If access is denied: set `AccessAllowed` false and `ErrorMessage`, and stop.
4. Request the header through [Get policy header](get-policy-header.md) with the policy number, customer id, and user type code.
5. Save the header to the session and set `AccessAllowed` true.
   - On exception: capture `ex.Message` into `ErrorMessage`.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([TryGetPolicyHeader]) --> D1{Session header matches policy?}
	D1 -->|Yes| EndOk([Use session header])
	D1 -->|No| D2{Access valid for user?}
	D2 -->|No| EndErr([Set error message])
	D2 -->|Yes| S1[Get policy header]
	S1 --> S2[Save to session]
	S2 --> EndOk
```

## Failure and edge-case behavior

- Reuse of a session header means a revoked association remains visible until the session ends.
- The access check result comes from a blocking `Task.Result` call.

## Related documentation
- [Index](../index.md)
- [Overview](../overview.md)
- [Architecture](../architecture.md)
- [Dependencies](../dependencies.md)
- [Configuration](../configuration.md)
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)
- [Service registration](../service-registration.md)
- [API reference](../api/index.md)

## Sources
- src/BolMiddleware/Models/BolPolicyModel.cs
- src/BolMiddleware/Services/Security/SecurityService.cs
- src/BolMiddleware/Extensions/BolMiddlewareExtensions.cs