---
title: SAIF.Application.Claim security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control for the claim-context application manager library.
status: draft
owner: SAIF Claims BOF team
last_reviewed: 2026-08-21
library: SAIF.Application.Claim
reference_type: embedded
---

# SAIF.Application.Claim security and authorization

This page documents authorization mechanisms implemented or consumed by `SAIF.Application.Claim`. Authentication is out of scope — this library receives an already-authenticated `clsSecurityPrincipal`/`WindowsIdentity` and performs authorization only.

## Authorization architecture

Authorization is entirely programmatic and layered on an inherited AD-resource-token pattern (`UserAccess.HasAccess`). No direct WCF `SecurityService` client code is present in this library — any WCF call underlying `HasAccess` is encapsulated inside the external `SAIF.Application` project reference and is not observable from this library's source*. `ClaimUserAccess` (per-user AD-resource access token) is combined by `ClaimSecurity` (per-claim access decision) with each `clsClaimData` instance's characteristic flags; `ClaimAppManager.OnCheckSecurity()` is the single enforcement point that consumes the result.

```mermaid
flowchart TD
    Caller["Concrete claim-screen<br>AppManager subclass"] --> CAM["ClaimAppManager.OnCheckSecurity()"]
    CAM --> SEC["ClaimSecurity.CheckClaim()"]
    SEC --> UA["ClaimUserAccess"]
    UA --> BaseUA["UserAccess.HasAccess()<br>(SAIF.Application, local ref)"]
    BaseUA --> AD[("Active Directory<br>(encapsulated, not observable)")]
    CAM --> Override["CheckForSecurityOverride()"]
    Override --> CS["ClaimServices.HasOverrideAcess()<br>(unresolved external dependency)"]
```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `SecureClaim` | Grants access to claims flagged as involving a hostile worker (`IsHostileWorker`). Constant key `SECURECLAIMSECURITYKEY`. | `ClaimUserAccess.SecureClaimAccess` → `HasAccess("SecureClaim")`; consumed by `ClaimSecurity.CheckClaim` to set `m_SecureClaimAccess`, enforcing [BR-CLM-004](business-rules.md#br-clm-004-hostile-secure-claim-access-restriction). | `SAIF.Application.Claim\ClaimUserAccess.vb` |
| `ConflictClaim` | Grants access to claims flagged as a worker conflict (`IsWorkerConflict`). Constant key `CONFLICTSECURITYKEY`. | `ClaimUserAccess.ConflictAccess` → `HasAccess("ConflictClaim")`; consumed by `ClaimSecurity.CheckClaim` to set `m_ConflictAccess`, which directly gates `ClaimAppManager.OnCheckSecurity()`'s hard `MarkNoAccess()` denial ([BR-CLM-001](business-rules.md#br-clm-001-conflict-claim-access-restriction)). | `SAIF.Application.Claim\ClaimUserAccess.vb`; `SAIF.Application.Claim\ClaimAppManager.vb` |
| `ExposureClaim` | Grants access to claims flagged as an exposure claim (`IsExposure`), and indirectly to health-issue claims that are also exposure claims. Constant key `EXPOSURESECURITYKEY`. | `ClaimUserAccess.ExposureAccess` → `HasAccess("ExposureClaim")`; consumed by `ClaimSecurity.CheckClaim` to set both `m_ExposureAccess` ([BR-CLM-002](business-rules.md#br-clm-002-exposure-claim-access-restriction)) and (conditionally) `m_HealthIssueAccess` ([BR-CLM-003](business-rules.md#br-clm-003-health-issue-claim-access-restriction)). | `SAIF.Application.Claim\ClaimUserAccess.vb` |
| `CollateralHealthClaim` | Named/intended to grant access to health-issue claims. Constant key `HEALTHISSUESECURITYKEY`. | `ClaimUserAccess.HealthIssueAccess` → `HasAccess("CollateralHealthClaim")`. **Declared but never consulted**: `ClaimSecurity.CheckClaim` gates health-issue access using `UserAccess.ExposureAccess`, not `UserAccess.HealthIssueAccess`, so this resource key currently has no effect on the computed [BR-CLM-003](business-rules.md#br-clm-003-health-issue-claim-access-restriction) flag*. | `SAIF.Application.Claim\ClaimUserAccess.vb`; `SAIF.Application.Claim\ClaimSecurity.vb` |

All four resource names are base names per the SAIF `<ResourceName>Resource`/`<ResourceName>TestResource` convention; the environment suffix is applied inside the inherited `UserAccess.HasAccess`/`IsAuthorized` implementation (in `SAIF.Application`, outside this library's scope), not in this library's code*.

## Authorization enforcement points

No attribute-based authorization exists in this library (no MVC controllers/actions, no `[SAIFAuthorize]`/`[SaifAuthorize]` decorations — this is a Component-tier application-manager library, not a presentation-layer project). All enforcement is programmatic.

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `ClaimAppManager` | `OnCheckSecurity()` | `ConflictClaim` (direct hard gate); `ExposureClaim`, `SecureClaim`, `CollateralHealthClaim` (flags computed but not directly gated here) | Programmatic lifecycle override; primary enforcement point. Runs on every successful context change, enforcing [BR-CLM-001](business-rules.md#br-clm-001-conflict-claim-access-restriction) through [BR-CLM-005](business-rules.md#br-clm-005-default-view-only-access-on-context-change). | `SAIF.Application.Claim\ClaimAppManager.vb` |
| `ClaimAppManager` | `CheckForSecurityOverride()` | N/A — delegates entirely to an external call | `Return ClaimServices.HasOverrideAcess(DPI, ClaimData.ClaimID, SecurityPrincipal.UserName.ToString)`. This is the only path by which a `ConflictClaim`-access denial can be bypassed for [BR-CLM-001](business-rules.md#br-clm-001-conflict-claim-access-restriction). `ClaimServices` is not defined anywhere in this library or elsewhere in the scanned repository**. | `SAIF.Application.Claim\ClaimAppManager.vb` |
| `ClaimSecurity` | `CheckClaim(inClaim As clsClaimData)` | All four resources | Rule-evaluation logic (not itself an enforcement point); recomputes all four access flags from the current `ClaimUserAccess` token and the passed-in claim's characteristic flags. | `SAIF.Application.Claim\ClaimSecurity.vb` |
| `ClaimAppManager` | `OnCreateDataLayer()` | N/A (fail-safe, not resource-based) | On a caught exception while establishing the Oracle data portal, calls `MarkContextNotSet()` and `MarkNoAccess()` before re-throwing — a connectivity-failure fail-closed behavior rather than an AD-resource check. | `SAIF.Application.Claim\ClaimAppManager.vb` |

## Data-level authorization

`ClaimSecurity.CheckClaim(inClaim As clsClaimData)` is a composite, per-claim data-level authorization check combining a claim characteristic with an AD-resource membership flag:

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Claim (conflict) | `ClaimSecurity.CheckClaim` | `inClaim.IsWorkerConflict` + `UserAccess.ConflictAccess` ([BR-CLM-001](business-rules.md#br-clm-001-conflict-claim-access-restriction)) | `SAIF.Application.Claim\ClaimSecurity.vb` |
| Claim (exposure) | `ClaimSecurity.CheckClaim` | `inClaim.IsExposure` + `UserAccess.ExposureAccess` ([BR-CLM-002](business-rules.md#br-clm-002-exposure-claim-access-restriction)) | `SAIF.Application.Claim\ClaimSecurity.vb` |
| Claim (health issue) | `ClaimSecurity.CheckClaim` | `inClaim.IsHealthIssue AndAlso inClaim.IsExposure` + `UserAccess.ExposureAccess` — **not** `UserAccess.HealthIssueAccess`* ([BR-CLM-003](business-rules.md#br-clm-003-health-issue-claim-access-restriction)) | `SAIF.Application.Claim\ClaimSecurity.vb` |
| Claim (hostile/secure) | `ClaimSecurity.CheckClaim` | `inClaim.IsHostileWorker` + `UserAccess.SecureClaimAccess` ([BR-CLM-004](business-rules.md#br-clm-004-hostile-secure-claim-access-restriction)) | `SAIF.Application.Claim\ClaimSecurity.vb` |

Of the four computed flags, only `ConflictAccess` is directly consumed by this library's own enforcement code (`OnCheckSecurity()`'s hard `MarkNoAccess()` gate); `ExposureAccess`, `HealthIssueAccess`, and `SecureClaimAccess` are exposed as public read-only properties for external callers (e.g., screen-level field/section visibility logic outside this library) to consult and enforce themselves* — this library does not itself hide or block access to exposure/health-issue/hostile-worker data beyond exposing these flags.

No entity-ownership validation methods (e.g., `IsValidPolicyForCurrentUser`) were found in this library; `ClaimAppManager.OnValidContext()` checks `ContextSet`, `SecurityRole <> NoAccess`, and `ClaimData.IsValid`, which is a context-validity check rather than an ownership check.

## Segregation of duties

None found. No segregation-of-duties classes, methods, or SQL privilege-combination checks exist in this library's source.

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `UserAccess` | Base type supplying `HasAccess` AD-resource lookup (local project reference, `SAIF.Application`, not re-documented here) | `ClaimUserAccess` | `SAIF.Application.Claim\ClaimUserAccess.vb` |
| `clsSecurityPrincipal` | Authenticated principal type (external, `SAIF.Business`/framework package) | `ClaimSecurity` constructors | `SAIF.Application.Claim\ClaimSecurity.vb` |

No `ISecurityManager`/`IClaimSecurityManager`/`DomainSecurityManagerBase` implementations exist directly in this library — `UserAccess.HasAccess` (the actual AD lookup) is implemented in `SAIF.Application`, outside this library's scope*.

## Notes
- **Machine/application authorization**: not present — no machine-account (`$`-suffixed `SAMAccountName`) validation or `MachineSecurityService` usage exists in this library's source.
- **Coverage assessment**: of the four resource keys defined, only two (`SecureClaim`'s underlying hostile-worker check and `ConflictClaim`) are fully wired end-to-end from resource lookup to an access-affecting outcome; `ExposureClaim` gates its own flag correctly but the flag is not itself consulted by `OnCheckSecurity()`*; `CollateralHealthClaim` is defined and exposed but not consulted at all by `ClaimSecurity.CheckClaim`, making it effectively dead from this library's perspective*.
- Mark inferred statements with `*` and unknown statements with `**`. Do not use bold inline confidence labels.
- AD resource names listed here use base names only. The framework appends `Resource` (production) or `TestResource` (non-production) at runtime.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [API reference](api/index.md)

## Sources
- `SAIF.Application.Claim\ClaimAppManager.vb`
- `SAIF.Application.Claim\ClaimSecurity.vb`
- `SAIF.Application.Claim\ClaimUserAccess.vb`
- `SAIF.Application.Claim\ClaimAppConstants.vb`
- `SAIF.Application.Claim\ClaimContext.vb`
- `SAIF.Application.Claim\SAIF.Application.Claim.vbproj`