---
title: ClaimSecurity
summary: API reference for ClaimSecurity.
status: draft
owner: SAIF Claims BOF team
last_reviewed: 2026-08-21
library: SAIF.Application.Claim
reference_type: embedded
---

# ClaimSecurity

`ClaimSecurity` computes the four per-claim, per-user access flags — conflict, exposure, secure/hostile, and health-issue — by combining a specific claim's characteristic flags (`IsWorkerConflict`, `IsExposure`, `IsHealthIssue`, `IsHostileWorker`) with the current user's AD-resource membership token (`ClaimUserAccess`). It is the rule-evaluation logic consumed by `ClaimAppManager.OnCheckSecurity()` (see [Security enforcement](../../operations/security-enforcement.md)) but is not itself an enforcement point — it produces flags, it does not call `MarkNoAccess`/`MarkViewOnly`.

## Purpose
- Evaluate [BR-CLM-001](../../business-rules.md#br-clm-001-conflict-claim-access-restriction) through [BR-CLM-004](../../business-rules.md#br-clm-004-hostile-secure-claim-access-restriction) for a given claim and user.
- Expose the resulting access flags as public read-only properties for `ClaimAppManager` and external callers (e.g., screen-level field/section visibility logic) to consult.

## Context
- Namespace: `SAIF.Application.Claim`
- Assembly/package: `SAIF.Application.Claim`

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `New(inUserAccess)` | `Public Sub New(inUserAccess As ClaimUserAccess)` | Constructs the security evaluator from an existing per-user AD-resource access token. |
| `New(inPrincipal)` | `Public Sub New(inPrincipal As clsSecurityPrincipal)` | Constructs the security evaluator from an authenticated principal, internally building a `ClaimUserAccess` token. |
| `ConflictAccess` | `Public ReadOnly Property ConflictAccess As Boolean` | `False` when the claim is a worker-conflict claim the user lacks access to; drives the hard `MarkNoAccess()` gate in [BR-CLM-001](../../business-rules.md#br-clm-001-conflict-claim-access-restriction). |
| `UserAccess` | `Public ReadOnly Property UserAccess As ClaimUserAccess` | Exposes the underlying per-user AD-resource access token used for all four flag computations. |
| `ExposureAccess` | `Public ReadOnly Property ExposureAccess As Boolean` | `False` when the claim is an exposure claim the user lacks access to, per [BR-CLM-002](../../business-rules.md#br-clm-002-exposure-claim-access-restriction). |
| `SecureClaimAccess` | `Public ReadOnly Property SecureClaimAccess As Boolean` | `False` when the claim involves a hostile worker the user lacks secure-claim access to, per [BR-CLM-004](../../business-rules.md#br-clm-004-hostile-secure-claim-access-restriction). |
| `HealthIssueAccess` | `Public ReadOnly Property HealthIssueAccess As Boolean` | `False` only when the claim is both a health-issue and exposure claim and the user lacks exposure access, per [BR-CLM-003](../../business-rules.md#br-clm-003-health-issue-claim-access-restriction). Gated by `ExposureAccess`, not `ClaimUserAccess.HealthIssueAccess` — see the tech-debt note on that rule*. |
| `CheckClaim(inClaim)` | `Public Sub CheckClaim(inClaim As clsClaimData)` | Recomputes all four access flags from scratch against the passed-in claim's characteristic flags and the current `ClaimUserAccess` token; the underlying rule-evaluation logic for [Security enforcement](../../operations/security-enforcement.md). |

## Behavioral notes
- Serializable (`<Serializable>` attribute).
- Only `ConflictAccess` is directly consumed by `ClaimAppManager`'s own enforcement code; `ExposureAccess`, `HealthIssueAccess`, and `SecureClaimAccess` are exposed for external callers to enforce themselves*.
- **Tech debt**: `HealthIssueAccess` gates on `UserAccess.ExposureAccess`, not `UserAccess.HealthIssueAccess` (backed by the `CollateralHealthClaim` AD resource), making the `CollateralHealthClaim` resource key effectively dead from this library's perspective — see [BR-CLM-003](../../business-rules.md#br-clm-003-health-issue-claim-access-restriction)**.

## Constraints and usage notes
- Constructing via `New(inPrincipal)` builds a `ClaimUserAccess` token internally; constructing via `New(inUserAccess)` allows callers to supply a pre-built token.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Application.Claim\ClaimSecurity.vb`