---
title: SAIF.Framework.Security business rules
summary: Enumerated business rules with per-rule trigger, enforcement, and outcomes for SAIF.Framework.Security.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.Security
reference_type: package
---

# SAIF.Framework.Security business rules

This page captures business rules enforced by this library.

## BR-001: WCF resource names are environment-suffixed

| Field | Value |
| --- | --- |
| **Statement** | AD resource names are environment-suffixed (`Resource` for Prod, `TestResource` otherwise) before being sent to the WCF `SecurityService`. |
| **Trigger** | Any `IsAuthorized(ResourceName)` / `IsAuthorized(ResourceName, Env)` call. |
| **Enforcement** | `clsSecurityPrincipal.IsAuthorized` (`SAIF.Framework.Security\clsSecurityPrincipal.vb:288-296`). |
| **Outcome** | Production and non-production environments are authorized against distinct AD groups, preventing cross-environment privilege bleed. |
| **Source** | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |

---

## BR-002: Legacy ASMX resource checks use a plain `Test` suffix

| Field | Value |
| --- | --- |
| **Statement** | Legacy AD resource checks append a plain `Test` suffix (not `TestResource`) in non-production. |
| **Trigger** | Any call to `clsAccountMaintProxy.ResourceAccessValid*` or `GetWhoHasAccess`. |
| **Enforcement** | `clsAccountMaintProxy.vb` (multiple methods, e.g., `SAIF.Framework.Security\clsAccountMaintProxy.vb:107-115`). |
| **Outcome** | Legacy ASMX-based checks use a different (inconsistent) naming convention than the WCF-based `IsAuthorized` path — same underlying business intent (environment isolation) but a different suffix format. |
| **Source** | `SAIF.Framework.Security\clsAccountMaintProxy.vb` |

---

## BR-003: Machine security group names use `Test`+`Resource` suffixing

| Field | Value |
| --- | --- |
| **Statement** | Machine security group/resource names append `Test` then `Resource` suffixes when `isResource=True` and `useProductionSecurityResource=False`. |
| **Trigger** | `MachineSecurityService.IsAuthorized` call. |
| **Enforcement** | `SAIF.Framework.Security\Utilities\MachineSecurityService.vb:20-24`. |
| **Outcome** | Machine/service-account authorization also respects environment isolation, matching the WCF `IsAuthorized` convention rather than the legacy ASMX convention. |
| **Source** | `SAIF.Framework.Security\Utilities\MachineSecurityService.vb` |

---

## BR-004: `ASPNET` and anonymous identities are never authenticated on Web

| Field | Value |
| --- | --- |
| **Statement** | A user is not considered authenticated on the Web platform if the resolved identity is anonymous or is the built-in `ASPNET` account. |
| **Trigger** | `InitWindowsIdentity` during `clsSecurityPrincipal` construction. |
| **Enforcement** | `SAIF.Framework.Security\clsSecurityPrincipal.vb:172-186`. |
| **Outcome** | Prevents the framework from treating the ASP.NET worker process identity as an authenticated end user. |
| **Source** | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |

---

## BR-005: Unqualified role names are domain-qualified before an `IsInRole` check

| Field | Value |
| --- | --- |
| **Statement** | Role names not already in `Domain\Role` FQN form are qualified using the current principal's own domain before the role check. |
| **Trigger** | `IsInRole(RoleName)` call with an unqualified role name. |
| **Enforcement** | `SAIF.Framework.Security\clsSecurityPrincipal.vb:308-318` (`FromFQN`/`ToFQN`). |
| **Outcome** | Ensures role/group lookups are always domain-qualified when sent to the `SecurityService`. |
| **Source** | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |

---

## BR-006: Changing identity properties logs the principal out

| Field | Value |
| --- | --- |
| **Statement** | Changing `UserName`, `Domain`, or `Password` on an existing `clsSecurityPrincipal` instance immediately logs the principal out (clears authenticated state, un-impersonates). |
| **Trigger** | Setting `UserName`, `Domain`, or `Password` property. |
| **Enforcement** | `SAIF.Framework.Security\clsSecurityPrincipal.vb:70-91` (property setters) calling `Logout()` (`SAIF.Framework.Security\clsSecurityPrincipal.vb:325-334`). |
| **Outcome** | Prevents stale authorization/impersonation state from persisting after credentials are changed. |
| **Source** | `SAIF.Framework.Security\clsSecurityPrincipal.vb` |

---

## BR-007: Internal network addresses are limited to a fixed prefix set

| Field | Value |
| --- | --- |
| **Statement** | Internal network addresses are recognized only for `10.*`, `127.0.0.1`, and `::1` prefixes.* |
| **Trigger** | `clsEnvironment.InternalAddress(Address)` call. |
| **Enforcement** | `SAIF.Framework.Security\clsEnvironment.vb`. |
| **Outcome** | Provides a coarse internal-vs-external network classification used by callers (e.g., to select internal vs. external authorization paths).* |
| **Source** | `SAIF.Framework.Security\clsEnvironment.vb` |

---

## BR-008: Machine authorization fails closed on service error

| Field | Value |
| --- | --- |
| **Statement** | `Utilities.MachineSecurityService.IsAuthorized` fails closed (returns not-authorized) when the underlying WCF `GetUsersByGroup` call throws, since the exception handler only logs via `Debug.WriteLine` and never sets the result to found. |
| **Trigger** | Any exception raised while calling `SecurityService.SecurityClient.GetUsersByGroup`. |
| **Enforcement** | `SAIF.Framework.Security\Utilities\MachineSecurityService.vb:29-36`. |
| **Outcome** | Guarantees a safe default (not-authorized) if the WCF endpoint is unreachable or throws, at the cost of silently swallowing the underlying error detail. |
| **Source** | `SAIF.Framework.Security\Utilities\MachineSecurityService.vb` |

## Notes
- Mark inferred statements with `*` and unknown statements with `**`. Do not use bold inline confidence labels.
- No stored-procedure or database-backed business rules exist for this library; it performs no database access of any kind.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Configuration](configuration.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts.

## Sources
- `SAIF.Framework.Security\clsSecurityPrincipal.vb`
- `SAIF.Framework.Security\clsAccountMaintProxy.vb`
- `SAIF.Framework.Security\Utilities\MachineSecurityService.vb`
- `SAIF.Framework.Security\clsEnvironment.vb`