---
title: UserAccess
summary: API reference for UserAccess.
status: draft
owner: SAIF BOF documentation team
last_reviewed: 2026-08-21
library: SAIF.Application
reference_type: embedded
---

# UserAccess

`UserAccess` is the abstract base for AD-resource-name-based authorization checks with per-instance caching. Concrete `AppManagerBase`/domain-manager subclasses mix in or inherit this class to gate access to arbitrary, caller-supplied AD resources without this library needing to know their concrete names ([Check and cache AD resource authorization](../../operations/check-and-cache-ad-resource-authorization.md)).

## Purpose
- Delegate AD-resource authorization decisions to `clsSecurityPrincipal.IsAuthorized(resourceName)` (from `SAIF.BOF.Framework.Security`), caching each result for the life of the instance ([BR-APP-003](../../business-rules.md#br-app-003-cached-ad-resource-authorization-result)).
- Provide a generic, parameterized mechanism whose concrete AD resource names are supplied entirely by callers/subclasses — no names are hardcoded in this library (see [Security and authorization](../../security-authorization.md)).

## Context
- Namespace: `SAIF.Application`
- Assembly/package: `SAIF.Application` (embedded library)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `HasAccess` | `Public Function HasAccess(inResourceName As String) As Boolean` | Returns whether the associated principal is authorized for the given AD resource name, checking a per-instance cache first and delegating to `clsSecurityPrincipal.IsAuthorized` on a cache miss ([BR-APP-003](../../business-rules.md#br-app-003-cached-ad-resource-authorization-result)). |
| `CheckAccess` | `Public Sub CheckAccess(ParamArray inResourceName As String())` | Iterates the supplied resource names and calls `HasAccess` for each, warming the cache; the per-call result is discarded and never returned, so this method by itself enforces nothing observable.* |
| `SetPrincipal` | `Protected Sub SetPrincipal(inPrincipal As clsSecurityPrincipal)` | Associates the `clsSecurityPrincipal` this instance will use for authorization checks. |

## Behavioral notes
- The internal cache (`m_AccessControl`) is a case-insensitive `SortedList(Of String, Boolean)` keyed on `inResourceName.ToLower`.
- `CheckAccess`'s discarded result means its practical effect (cache warming vs. incomplete implementation) is ambiguous without seeing call sites in consuming libraries.*

## Constraints and usage notes
- A cached `HasAccess` result could be stale if the underlying AD membership changes during the instance's lifetime.*
- No AD resource-name literals are declared in this library; concrete names must be supplied by callers.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts.

## Sources
- `SAIF.Application\UserAccess.vb`