---
title: Build named role policies
summary: Builds ASP.NET Core authorization policies from consumer-declared roles, one RoleRequirement per role.
status: draft
owner: SAIF Platform Team
last_reviewed: 2026-10-02
library: SAIF.NetCore.NtlmApiAuth
reference_type: package
operation_id: OP-02
trigger: First resolution of IOptions<AuthorizationOptions>
---

# Build named role policies

Converts each consumer-declared `AddPolicies(string policyName, params string[] roles)` call into a named ASP.NET Core authorization policy containing one `RoleRequirement` per role.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-02 |
| **Trigger** | First resolution of `IOptions<AuthorizationOptions>` (options framework) |
| **Inputs** | Framework `AuthorizationOptions`; consumer `SetPolicies()` override |
| **Outputs** | `AuthorizationOptions` populated with named policies |
| **Primary components** | `ConfigureRoleAuthorizationOptions.Configure`, `AddPolicies` |
| **Entry point** | `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Options/ConfigureRoleAuthorizationOptions.cs` |

## Steps

1. Store the framework `AuthorizationOptions` in the `AuthorizationOptions` property.
2. Call the consumer's `SetPolicies()` override (abstract).
3. For each `AddPolicies(string policyName, params string[] roles)` call, create one `RoleRequirement(role, AuthorizationService)` per role. ([BR-NTLM-012](../business-rules.md#br-ntlm-012-policies-defined-by-subclassing-configureroleauthorizationoptions))
4. Call `AuthorizationOptions.AddPolicy(policyName, policy => policy.AddRequirements(requirements))`. ([BR-NTLM-007](../business-rules.md#br-ntlm-007-multi-role-policies-are-and))
   - A duplicate `policyName` is replaced or throws per the framework's own `AuthorizationOptions.AddPolicy` behavior; this library does not guard against it.

## Process flow

```mermaid
flowchart TD
	Start([IOptions resolved]) --> S1[Consumer SetPolicies invoked]
	S1 --> S2[For each AddPolicies call]
	S2 --> S3[Create one RoleRequirement per role]
	S3 --> S4[AuthorizationOptions.AddPolicy with all requirements]
	S4 --> End([Named policy registered])
```

## Failure and edge-case behavior
- Multi-role policies behave as AND, not OR, because every `RoleRequirement` must succeed ([BR-NTLM-007](../business-rules.md#br-ntlm-007-multi-role-policies-are-and)).

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Options/ConfigureRoleAuthorizationOptions.cs`