---
title: Security enforcement
summary: Recomputes per-claim access flags and gates access on every successful context change.
status: draft
owner: SAIF Claims BOF team
last_reviewed: 2026-08-21
library: SAIF.Application.Claim
reference_type: embedded
operation_id: OP-CLM-003
trigger: Step 3 of ChangeContext(), invoked whenever a context is successfully set.
---

# Security enforcement

Protected override on `ClaimAppManager` (`OnCheckSecurity`) that is the primary authorization enforcement point in this library.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-CLM-003 |
| **Trigger** | Step 3 of `ChangeContext()`, whenever `ContextSet` becomes true after a `SetClaimContext`/`SetWorkerContext` call. |
| **Inputs** | Current `ClaimData` |
| **Outputs** | Security/access state (`SecurityRole`, `Message`) |
| **Primary components** | `ClaimAppManager.OnCheckSecurity`, `ClaimSecurity.CheckClaim`, `ClaimAppManager.CheckForSecurityOverride` |
| **Entry point** | `SAIF.Application.Claim\ClaimAppManager.vb` |

## Steps

1. Call `ClaimSecurity.CheckClaim(ClaimData)` — evaluates [BR-CLM-001](../business-rules.md#br-clm-001-conflict-claim-access-restriction), [BR-CLM-002](../business-rules.md#br-clm-002-exposure-claim-access-restriction), [BR-CLM-003](../business-rules.md#br-clm-003-health-issue-claim-access-restriction), and [BR-CLM-004](../business-rules.md#br-clm-004-hostile-secure-claim-access-restriction) against the claim, using the current user's `ClaimUserAccess` token. No SQL/table access at this step (in-memory flag evaluation only).
2. Call `MarkViewOnly()` unconditionally — defaults every context change to view-only, per [BR-CLM-005](../business-rules.md#br-clm-005-default-view-only-access-on-context-change).
3. If `Not ClaimSecurity.ConflictAccess` **and** `Not CheckForSecurityOverride()`, call `MarkNoAccess()` and set `Message = ConfidentialAccessDeniedMessage`.
   - This enforces [BR-CLM-001](../business-rules.md#br-clm-001-conflict-claim-access-restriction) as a hard access denial (not just view-only) unless a security override applies.
   - `CheckForSecurityOverride()` delegates to `ClaimServices.HasOverrideAcess(DPI, ClaimData.ClaimID, SecurityPrincipal.UserName.ToString)` — an operation implemented in an externally-packaged business-services library; `ClaimServices` is not defined anywhere in this library or the rest of the scanned repository, so its internal logic is unresolved**.

## Process flow

```mermaid
flowchart TD
	Start([OnCheckSecurity invoked]) --> Check[ClaimSecurity.CheckClaim]
	Check --> ViewOnly[MarkViewOnly]
	ViewOnly --> Conflict{ConflictAccess?}
	Conflict -->|Yes| Allowed([Access retained])
	Conflict -->|No| Override{CheckForSecurityOverride?}
	Override -->|Yes| Allowed
	Override -->|No| Denied([MarkNoAccess<br>ConfidentialAccessDeniedMessage])
```

## Failure and edge-case behavior

- Conflict claim with no access and no override: hard denial via `MarkNoAccess()`, see [BR-CLM-001](../business-rules.md#br-clm-001-conflict-claim-access-restriction).
- `ClaimServices.HasOverrideAcess` internal logic cannot be verified — unresolved external dependency**.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

> **Note:** Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `SAIF.Application.Claim\ClaimAppManager.vb`
- `SAIF.Application.Claim\ClaimSecurity.vb`