---
title: "Security and authorization"
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control
status: draft
owner: SAIF.Core documentation team
last_reviewed: 2026-09-24
library: SAIF.Data.NHibernate
reference_type: package
---

# SAIF.Data.NHibernate security and authorization

This page documents authorization mechanisms implemented or consumed by SAIF.Data.NHibernate. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level. This library references **no Active Directory resource names** and enforces **no role checks directly** — its security relevance is entirely data-level: `GroupImageRepository` applies confidential- and deleted-image visibility filters driven by caller-supplied boolean flags, `PolicyOutputDocumentRepository` scopes agency document visibility, `ClaimBillEntryRepository` forwards the caller's conflict-claim access flag to the bill queue API, and several ClassMaps expose claim security attributes and debtor SSNs (PII) with no access check at this layer.

> [!WARNING]
> **HIGH severity finding (SC-SDN-01):** `GroupImageRepository.GetFilteredImageGroups`'s deleted-image visibility filter is **logically inverted**. See [Security concerns](#security-concerns) below for full detail — this is the most significant finding in this document.

## Authorization architecture

Authorization is not implemented in this library. All visibility/access decisions are expressed as query filters driven by boolean flags computed upstream by `SAIF.Services` (e.g., `GroupImageSecurityProvider.CanUserSeeConfidentialImages()`/`CanUserSeeDeletedImages()`, based on AD resources `GroupImagingConfidential`/`GroupImagingDeleted`) and passed in as method parameters or `ImageFilterCriteria` properties. This library never queries Active Directory, never checks `IsInRole`/`IsAuthorized`, and has no `[SAIFAuthorize]` attributes, controllers, or actions.

```mermaid
flowchart TD
    Caller["SAIF.Services caller<br>(computes AD-resource-backed flags)"] --> Repo["SAIF.Data.NHibernate repository<br>(GroupImageRepository, PolicyOutputDocumentRepository, etc.)"]
    Repo --> Filter["In-memory / query-scoping filter<br>using caller-supplied flag"]
    Filter --> DB["Oracle / SQL Server"]
```

## AD resource catalog

None found. A scan of compiled `.cs`, `.hbm.xml`, and `.config` files under `Data/SAIF.Data.NHibernate/` found no AD resource-name constants or literals, no `IsInRole`/`IsAuthorized` calls, no `Principal`/`WindowsIdentity` usage, no `System.DirectoryServices` usage, and no LDAP strings.

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| None | — | — | — |

## Authorization enforcement points

### Attribute-based authorization

None found. The library has no controllers, actions, or authorization attributes.

### Programmatic authorization checks

None found. No method in this library checks AD membership directly. Visibility filtering is driven entirely by boolean flags supplied by the caller (see Data-level authorization below).

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| `ImageGroup` / `Image` (table [Image_Group](database-tables.md#image_group)), confidential images (DLA-SDN-01) | `GroupImageRepository.GetFilteredImageGroups(string groupId, ImageFilterCriteria filter)` | In-memory LINQ filter after `ToList()`: keeps the image when `Image.SecurityLevel == Image.NonConfidentialSecurityLevel` or `filter.CanUserSeeConfidentialImages`. The flag originates from `Services/SAIF.Services/Groups/Imaging/ImageService.CreateGroupImageRepositoryFilter` → `GroupImageSecurityProvider.CanUserSeeConfidentialImages()` (AD resource `GroupImagingConfidential`)** | `Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs` |
| `ImageGroup` / `Image`, deleted images (DLA-SDN-02) | `GroupImageRepository.GetFilteredImageGroups` | In-memory filter `ig.Image.ImageDeleteCode != null \|\| filter.CanUserSeeDeletedImages`. Flag from `GroupImageSecurityProvider.CanUserSeeDeletedImages()` (AD resource `GroupImagingDeleted`). **This predicate is inverted** relative to the deletion convention used elsewhere — see [SC-SDN-01](#security-concerns) | `Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs` |
| `PolicyOutputDocument` (table [policy_output_document](database-tables.md#policy_output_document)), agency visibility (DLA-SDN-03) | `PolicyOutputDocumentRepository.GetReleasedAgencyViewablePolicyOutputDocuments`, `GetHeldAndPendingAgencyViewablePolicyOutputDocuments`, `ReleasedAgencyInboxViewableQuery`, `GetReleasedAgencyViewableChildOutputDocuments`; local extensions `AgencyViewable`/`AgencyInboxViewable` | Query-scoping filters restrict to document types with `agency_view_flag`/`agency_inbox_flag` = Y (mapped in `OutputDocumentTypeCodeBaseMap`) and to the supplied agency, producer, or policy. Duplicates the `SAIF.Data` `PolicyOutputDocumentExtensions` filters. The agency/producer/policy ids are caller-supplied and not validated against the current user at this layer* | `Data/SAIF.Data.NHibernate/Repositories/OutputDocuments/PolicyOutputDocumentRepository.cs`, `Data/SAIF.Data.NHibernate/Mappings/OutputDocuments/OutputDocumentTypeCodeBaseMap.cs` |
| Claim bill queue (`ClaimBillQueueTask`) (DLA-SDN-04) | `ClaimBillEntryRepository.GetNextClaimBillFromQueue(bool hasConflictAccess)` | Delegates to `SAIF.Data`'s `CCClaimApiService.GetNextClaimBillFromQueue(hasConflictAccess)`, which passes the flag to the Guidewire CC Claim Data API; the API applies the conflict-claim restriction**. The legacy named query `ClaimBillEntry_GetNextBillFromQueue` (see [procedures/pk82039-billentry-task-process.md](procedures/pk82039-billentry-task-process.md)) is still embedded but no longer invoked by the repository | `Data/SAIF.Data.NHibernate/Repositories/ClaimBillEntryRepository.cs`, `Data/SAIF.Data.NHibernate/Mappings/Claims/Bills/ClaimBillEntry.hbm.xml` |
| Claim security attributes and overrides (DLA-SDN-05) | Mapping only — no validation method in this library | `SecurityOverrideMap` maps `CL_SECURITY_OVERRIDE` (`WORKER_CONFLICT_FLAG`, `HOSTILE_WORKER_CODE`); `ClaimPersonMap` maps `WORKER_CONFLICT_FLAG`/`HOSTILE_WORKER_CODE`; `InjuryClaimMap` maps `EXTERNAL_VIEW_FLAG`/`TIN_AUTHORIZED_USE_FLAG`; `ClaimForOnBaseMap` maps `isconflictclaim`; `NotepadMap` maps `confidential_flag`; `OnBaseDocumentSubTypeMap`/`NotepadTypeMap` map `default_confidential_flag`. These columns feed claim-security decisions in `Services/SAIF.Services/Security/ClaimSecurityService.cs` | `Data/SAIF.Data.NHibernate/Mappings/Claims/SecurityOverride/SecurityOverrideMap.cs`, `Data/SAIF.Data.NHibernate/Mappings/Claims/ClaimPersonMap.cs`, `Data/SAIF.Data.NHibernate/Mappings/Claims/InjuryClaimMap.cs`, `Data/SAIF.Data.NHibernate/Mappings/Claims/Information/ClaimForOnBaseMap.cs`, `Data/SAIF.Data.NHibernate/Mappings/Notes/NotepadMap.cs` |

The direct-lookup methods `GroupImageRepository.GetImageGroup(long)`, `GetImageGroupOrDefault(long)`, and `ImageFound(long)` apply neither the confidential nor the deleted filter; any caller that exposes an image by id must enforce visibility itself*.

## Segregation of duties

None found. There are no SOD classes, no `employee_access`/`menu_structure` queries, and no conflicting-privilege rules enforced in this library. `ClaimAuthorityPurposeType` maps authority purposes (1 = ApproveReserves, 2 = InitiateReserves, 3 = Initiate, 4 = Approve; `Data/SAIF.Data.NHibernate/CustomTypes/ClaimAuthorityPurposeType.cs`), and `EmployeeAuthorityLimitMap`/`CaseCostMap` map `AUTHORIZED_BY_EMPLID`/`AUTHORIZER_EMPLID`; these persist initiate/approve data that could support a maker-checker rule, but no such rule is enforced in this library*.

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `ImageFilterCriteria` | Carries caller-computed visibility flags (`CanUserSeeConfidentialImages`, `CanUserSeeDeletedImages`) into `GroupImageRepository` | `GroupImageRepository.GetFilteredImageGroups` | `Data/SAIF.Data/Model/Groups/ImageFilterCriteria.cs` (defined in `SAIF.Data`)* |
| `ICCClaimApiService` | Carries the caller-supplied conflict-claim access flag into the Guidewire bill queue API | `ClaimBillEntryRepository` | `Data/SAIF.Data/Queries/Claims/CCClaimApiService.cs` (defined in `SAIF.Data`)* |

## Machine/application authorization

None found. The library performs no machine-account AD validation and holds no credentials. Database identity is supplied by the consuming application through `SAIF.Framework.Data.NHibernate`**.

## Security concerns

| ID | Severity | Concern | Source |
| --- | --- | --- | --- |
| **SC-SDN-01** | **High** | **Inverted deleted-image filter.** `GetFilteredImageGroups` keeps an image when `ImageDeleteCode != null \|\| CanUserSeeDeletedImages`. `GroupImageRepository.Delete` and `ImagingDataModelExtensions.IsDeleted` treat null, empty, or `" "` as *not deleted* and `"Y"` as *deleted*. For a user **without** `GroupImagingDeleted`, soft-deleted images (`"Y"`) therefore pass the filter and are returned, while never-deleted images with a null code are hidden. This is an **authorization bypass for deleted group images**. `SAIF.Services` `Groups/Imaging/ImageService.GetImages` relies on this filter and applies none of its own; by contrast, `Services/SAIF.Services/Agencies/Imaging/ImageService.cs` uses `!Image.IsDeleted() \|\| CanUserSeeDeletedImages` correctly | `Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs`, `Services/SAIF.Services/Interfaces/Imaging/ImagingDataModelExtensions.cs`, `Services/SAIF.Services/Groups/Imaging/ImageService.cs` |
| SC-SDN-02 | Medium | Both image visibility filters run in memory after `ToList()`, so every image in the group (including confidential and deleted ones) is loaded into the process before filtering. This is a performance and exposure-surface concern rather than a direct leak | `Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs` |
| SC-SDN-03 | Medium | PII: `CollectionsRepository.GetDebtorSsn` runs named query `Collections_GetDebtorSSN` ([SQL-008](sql/SQL-008-collections-repository-get-debtor-ssn.md)) and `SearchCollections` ([SQL-012](sql/SQL-012-collections-repository-search-collections.md)) accepts an SSN search parameter. No access check is present at this layer; callers must restrict it* | `Data/SAIF.Data.NHibernate/Repositories/CollectionsRepository.cs`, `Data/SAIF.Data.NHibernate/Mappings/Collections/Collections.hbm.xml`, `Data/SAIF.Data.NHibernate/Mappings/Collections/DebtorSsnMap.cs` |
| SC-SDN-04 | Low | EDI maps are bound to a personal Oracle schema `OPS$JIMMIL`, implying the application account needs grants on an individual's schema — a least-privilege and portability concern | `Data/SAIF.Data.NHibernate/Mappings/Edi/EdiElementMap.cs`, `Data/SAIF.Data.NHibernate/Mappings/Edi/EdiFileMap.cs`, `Data/SAIF.Data.NHibernate/Mappings/Edi/EdiSegmentMap.cs` |
| SC-SDN-05 | Informational | All inline SQL (`CreateSqlQuery`, named queries) uses bound parameters; no string concatenation of user input was observed | `Data/SAIF.Data.NHibernate/Repositories/**`, `Data/SAIF.Data.NHibernate/Mappings/**/*.hbm.xml` |
| SC-SDN-06 | Informational | `GroupImageRepository.Delete` performs a soft delete and stamps `UpdateUser`/`UpdateDate` from the caller-supplied `ImageDelete`, but does not check `CanUserEditImages`; enforcement is expected in the caller* | `Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs` |

## Notes
- Mark inferred statements with `*` and unknown statements with `**`. Statements above follow this convention.
- This library defines no AD resource names of its own; the resource names referenced above (`GroupImagingConfidential`, `GroupImagingDeleted`) are defined and consumed by `SAIF.Services`, not by this library — they are cited here for traceability only.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [Procedures](procedures/index.md)
- [API reference](api/index.md)

## Sources
- `Data/SAIF.Data.NHibernate/Repositories/Groups/GroupImageRepository.cs`
- `Data/SAIF.Data.NHibernate/Repositories/OutputDocuments/PolicyOutputDocumentRepository.cs`
- `Data/SAIF.Data.NHibernate/Repositories/ClaimBillEntryRepository.cs`
- `Data/SAIF.Data.NHibernate/Repositories/CollectionsRepository.cs`
- `Data/SAIF.Data.NHibernate/Mappings/Claims/Bills/ClaimBillEntry.hbm.xml`
- `Data/SAIF.Data.NHibernate/Mappings/Collections/Collections.hbm.xml`