---
title: SAIF.Application.Claim.Legal security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control.
status: draft
owner: SAIF Documentation Pipeline
last_reviewed: 2026-08-21
library: SAIF.Application.Claim.Legal
reference_type: embedded
---

# SAIF.Application.Claim.Legal security and authorization

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a `WindowsIdentity` on the request context.

## Authorization architecture

Authorization in this library is exclusively programmatic: every enforcement point is a Boolean property or inline conditional wrapping a call to `SecurityPrincipal.IsAuthorized(<key>)`, where `SecurityPrincipal` is the `clsSecurityPrincipal` instance (`SAIF.BOF.Framework.Security`) injected into every manager's constructor and exposed through the inherited `ClaimAppManager` base. There is no `[SAIFAuthorize]`/`[SaifAuthorize]` attribute-based gating in this library (this is an Application-tier BOF manager library, not an MVC controller library), and no direct WCF `SecurityService` proxy usage or AD/LDAP API calls are present — the concrete AD-group-membership resolution mechanism behind `IsAuthorized` is opaque to this library, implemented inside the external `clsSecurityPrincipal` type*.

```mermaid
flowchart TD
    UI["*Manager constructor<br>(inSecurityPrincipal)"] --> LMB["LegalManagerBase.OnRetrieve<br>(claim-level view gate)"]
    LMB --> Principal["clsSecurityPrincipal.IsAuthorized(key)"]
    CNM["clsCaseNotesManager<br>(note-level gate)"] --> Principal
    SCH["clsScheduleManager<br>(LCE flags)"] --> Principal
    Principal --> External["AD group resolution<br>(opaque — SAIF.BOF.Framework.Security)"]
```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `LNConflict` | Grants access to view claims flagged as worker-conflict cases. | `LegalManagerBase.HasLegalConflictAccess` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LNExposure` | Grants access to view claims flagged as exposure/confidential. | `LegalManagerBase.HasLegalExposureAccess` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LNAdmin` | Full Legal-admin bypass: unconditional claim-view access plus full note edit/delete rights. | `LegalManagerBase.IsInAdminGroup`; consumed by `LegalManagerBase.OnRetrieve` and `clsCaseNotesManager.CanUpdateAnyNote` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LNCaseUpdate` | Case-update role: broad note edit/delete rights and a general case-update flag exposed to callers*. | `LegalManagerBase.IsInCaseUpdateGroup`; consumed by `clsCaseNotesManager.CanUpdateAnyNote` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LNView` | View-only role flag; no additional branching logic found in this library beyond exposing the flag — likely consumed by the `Legal\` web front end to restrict UI controls**. | `LegalManagerBase.IsInViewOnly` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LNNoteView` | Grants case-note viewing capability. | `clsCaseNotesManager.IsInNoteView` | `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb` |
| `LNUpdate` | Grants bill-note (`DOCCO` category) update capability to non-admin/non-case-update users. | `clsCaseNotesManager.CanUpdateBillNotes` | `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb` |
| `LNLCEUpdate` | LCE (Legal Case Evaluation) update role; exposed but no further branching logic observed in this library beyond the getter**. | `clsScheduleManager.IsInLCEUpdateGroup` | `SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb` |
| `LNDueDateUpdate` | LCE due-date update role; same caveat as `LNLCEUpdate`**. | `clsScheduleManager.IsInLCEDueDateGroup` | `SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb` |

All 9 keys use the SAIF base-resource-name convention (no `Resource`/`TestResource` suffix visible in code — the suffix is appended internally by `clsSecurityPrincipal.IsAuthorized`)*.

## Authorization enforcement points

No attribute-based (`[SAIFAuthorize]`/`[SaifAuthorize]`) enforcement points exist in this library; all 11 enforcement points below are programmatic.

### Programmatic authorization checks

| Class | Method / Property | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `LegalManagerBase` | `OnRetrieve` (composite: `LNAdmin` bypass, else `HasLegalConflictAccess`/`LNConflict` + `CheckForSecurityOverride`, else `HasLegalExposureAccess`/`LNExposure` + `CheckForSecurityOverride`) | `LNAdmin`, `LNConflict`, `LNExposure` | `IsAuthorized` (composite orchestration) | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LegalManagerBase` | `IsInAdminGroup` | `LNAdmin` | `IsAuthorized` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LegalManagerBase` | `IsInCaseUpdateGroup` | `LNCaseUpdate` | `IsAuthorized` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LegalManagerBase` | `IsInViewOnly` | `LNView` | `IsAuthorized` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LegalManagerBase` | `HasLegalConflictAccess` | `LNConflict` | `IsAuthorized` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `LegalManagerBase` | `HasLegalExposureAccess` | `LNExposure` | `IsAuthorized` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `clsCaseNotesManager` | `CanUpdateAnyNote` (composite: `LNAdmin` OR `LNCaseUpdate`) | `LNAdmin`, `LNCaseUpdate` | `IsAuthorized` (composite property) | `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb` |
| `clsCaseNotesManager` | `CanUpdateBillNotes` | `LNUpdate` | `IsAuthorized` | `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb` |
| `clsCaseNotesManager` | `IsInNoteView` | `LNNoteView` | `IsAuthorized` | `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb` |
| `clsScheduleManager` | `IsInLCEUpdateGroup` | `LNLCEUpdate` | `IsAuthorized` | `SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb` |
| `clsScheduleManager` | `IsInLCEDueDateGroup` | `LNDueDateUpdate` | `IsAuthorized` | `SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb` |

All 22 concrete manager classes inherit the `LegalManagerBase.OnRetrieve` claim-level view gate. Only `clsCaseNotesManager` and `clsScheduleManager` add class-specific checks beyond this inherited gate; the remaining 19 concrete managers (Appeal, Assignment, Attorney/Hearing-Location/Person maintenance, Board Log, Case Cost, Case Search, Create File, Mail Date, Other Parties, Outcome, Quick Cal, Request, Summary, Update Case, Acknowledge, Attorney Messages) perform no additional security-key checks*.

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Case note | `clsCaseNotesManager.DeleteNote` | Composite check: deletion blocked unless `CanUpdateAnyNote` (`LNAdmin` OR `LNCaseUpdate`) or the note's `CategoryCode = "DOCCO"` (bill note); unconditionally blocked when `note.CreateUser = "SYSTEM"`, regardless of role. | `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb` |
| Case note (read) | `clsCaseNotesManager.GetNotes` | Per-note `CanUpdate`/`CanUpdateText` flags computed from `CanUpdateAnyNote`/`CanUpdateBillNotes` at retrieval time — a request-scoped, cached authorization result attached to each note for the presentation layer. | `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb` |
| Legal claim/case | `LegalManagerBase.OnRetrieve` | Composite check combining `ClaimData.IsWorkerConflict`/`ClaimData.IsExposure` entity attributes with `HasLegalConflictAccess`/`HasLegalExposureAccess` AD-resource checks and an external `CheckForSecurityOverride()` escape hatch (defined in `SAIF.Application.Claim`, not this library)*. | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `clsSecurityPrincipal` (`SAIF.BOF.Framework.Security`, external binary reference) | Injected security principal exposing `IsAuthorized(<key>)` (the sole authorization-check abstraction used by this library) and `GetDefaultPrinter()` (non-authorization, principal-derived configuration). | Every one of the 22 concrete `*Manager` classes and `LegalManagerBase`, via constructor injection (`inSecurityPrincipal As clsSecurityPrincipal`). | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |

## Notes
- No segregation-of-duties (SOD) rules were found — no classes/methods matching SOD naming conventions, no conflicting-privilege checks, and no machine/application (`$`-suffix) authorization patterns exist in this library.
- Mark inferred statements with `*` and unknown statements with `**`. Do not use bold inline confidence labels.
- AD resource names listed here use base names only. The framework appends `Resource` (production) or `TestResource` (non-production) at runtime.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [Configuration](configuration.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with `**` could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Application.Claim.Legal\LegalManagerBase.vb`
- `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb`
- `SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb`
- `SAIF.Application.Claim.Legal\LegalNet\clsAppealManager.vb`
- `SAIF.Application.Claim.Legal\LegalNet\clsCreateFileManager.vb`
- `SAIF.Application.Claim.Legal\LegalNet\clsMailDateManager.vb`
- `SAIF.Application.Claim.Legal\LegalNet\clsRequestManager.vb`
- `SAIF.Application.Claim.Legal\clsAttorneyTableManager.vb`
- `SAIF.Application.Claim.Legal\clsHearingLocationManager.vb`
- `SAIF.Application.Claim.Legal\clsLegalPersonManager.vb`
- `SAIF.Application.Claim.Legal\clsMaintenanceManager.vb`