---
title: SAIF.Application business rules
summary: Enumerated business rules with per-rule trigger, enforcement, and outcomes for the SAIF.Application base Application-tier abstraction layer.
status: draft
owner: SAIF BOF documentation team
last_reviewed: 2026-08-21
library: SAIF.Application
reference_type: embedded
---

# SAIF.Application business rules

This page captures business rules enforced by this library. SAIF.Application is an abstraction/plumbing layer and implements no domain business rules (e.g., claim/policy validation, pricing, eligibility); the rules below are structural/behavioral constraints enforced by this library's own code.

## BR-APP-001 Non-empty, non-duplicate message accumulation

| Field | Value |
| --- | --- |
| **Statement** | A message is appended to `AppManagerBase.Message` only if it is non-empty and not already contained in the current message string. |
| **Trigger** | A concrete subclass calls `AppendMessageLines` with a single message, an array of messages, or an `IEnumerable(Of String)`. |
| **Enforcement** | `AppManagerBase.AppendMessageLines(ByVal inMessage As String)` |
| **Outcome** | Empty strings are silently ignored; a message equal to a substring already present in `Message` is not re-appended, preventing duplicate/blank message noise in the accumulated display string. |
| **Source** | `SAIF.Application\AppManagerBase.vb` |

---

## BR-APP-002 Application access level gating

| Field | Value |
| --- | --- |
| **Statement** | An application manager's usable access level (`IsAccessible`, `IsUpdateable`, `IsViewOnly`, `IsRestricted`) is derived exclusively from the single `AppSecurityRole` value set via `MarkUpdate()`, `MarkViewOnly()`, or `MarkNoAccess()` (default `NoAccess`). |
| **Trigger** | A concrete subclass calls `OnCheckSecurity()` (its own implementation, not present in this library) and is expected to call one of the `Mark*` methods to set the resulting role. |
| **Enforcement** | `AppManagerBase.SecurityRole`, `IsAccessible`, `IsRestricted`, `IsUpdateable`, `IsViewOnly`, `MarkUpdate`, `MarkNoAccess`, `MarkViewOnly` |
| **Outcome** | Until a concrete subclass explicitly marks the role, the manager defaults to `NoAccess` (`IsRestricted = True`, `IsAccessible = False`), a fail-closed default.* |
| **Source** | `SAIF.Application\AppManagerBase.vb` |

---

## BR-APP-003 Cached AD resource authorization result

| Field | Value |
| --- | --- |
| **Statement** | Once a resource name's authorization result has been obtained from the security principal, it is cached for the lifetime of the `UserAccess`-derived instance and is not re-queried. |
| **Trigger** | `HasAccess(inResourceName)` is called one or more times for the same resource name on the same instance. |
| **Enforcement** | `UserAccess.HasAccess` |
| **Outcome** | The first call for a given resource name incurs a live `clsSecurityPrincipal.IsAuthorized` check (delegating to `SAIF.BOF.Framework`); subsequent calls for the same resource name on the same instance return the cached boolean without re-checking, which could return a stale result if the underlying AD membership changes during the instance's lifetime.* |
| **Source** | `SAIF.Application\UserAccess.vb` |

---

## BR-APP-004 Retrieve-none-write-none abstract contract

| Field | Value |
| --- | --- |
| **Statement** | Every concrete `AppManagerBase` subclass must supply its own `Retrieve()` and `Write()` implementations (and the supporting `On*` hooks); `AppManagerBase` provides no default retrieve/write behavior. |
| **Trigger** | Instantiation of any concrete subclass and any call to the inherited `Retrieve()`/`Write()` members. |
| **Enforcement** | `MustOverride` declarations for `OnInitialize`, `OnCreateDataLayer`, `OnContextChanged`, `OnCheckSecurity`, `OnTransactionStart`, `OnTransactionStop`, `OnRetrieve`, `OnWrite`, `OnValidContext`, `Retrieve`, `Write` |
| **Outcome** | The VB.NET compiler prevents instantiation of any subclass that does not implement all of these members, guaranteeing every concrete application manager defines its own initialize/retrieve/write/transaction/security/context-validity behavior. |
| **Source** | `SAIF.Application\AppManagerBase.vb` |

---

## Inherited business rules

Rules in this section originate from base classes or services provided by dependency framework libraries. They are enforced by inherited behavior, not by code in this library. The originating class and library are recorded in each rule's **Origin** field.

## INH-001 Rule-engine-backed broken-rule tracking

| Field | Value |
| --- | --- |
| **Statement** | Every concrete `AppManagerBase` subclass inherits a `clsRulesManager` instance (via `Rules`) that evaluates business rules in severity order and tracks broken rules, surfaced through `IDataErrorInfo`.† |
| **Trigger** | The inherited `Rules` collection is populated and evaluated as part of the base class's edit-session/save lifecycle (`BeginEdit`/`ApplyEdit`/`Save`).† |
| **Enforcement** | `clsBusinessBase.Rules`, `IDataErrorInfo.Error` / `Item(columnName)` |
| **Outcome** | Broken rules block `Save()`, which throws `ApplicationException` if the object is invalid after rule evaluation.† No evidence in `AppManagerBase.vb` shows this inherited machinery being invoked directly by this library's own code — it is available to concrete subclasses but not wired up here.* |
| **Origin** | `SAIF.Framework.Core` — `clsBusinessBase` |
| **Source** | Retrieved from indexed documentation via Legends CLI |

---

## Notes
- No domain business rules (claim/policy validation, pricing, eligibility) are implemented in this library — it is an abstraction/plumbing layer.
- Mark inferred statements with `*` and unknown statements with `**`. Do not use bold inline confidence labels.
- Statements marked with `†` were retrieved from dependency library documentation via the Legends CLI RAG service.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `†` are derived from dependency library
> documentation via the Legends CLI. Statements marked with `*` were inferred
> from code structure or contextual evidence.

## Sources
- `SAIF.Application\AppManagerBase.vb`
- `SAIF.Application\UserAccess.vb`
- Legends CLI RAG service (indexed documentation for `clsBusinessBase`, source library `SAIF.Framework.Core`)