---
title: clsPolicySecurity
summary: API reference for clsPolicySecurity.
status: draft
owner: SAIF Claims BOF team
last_reviewed: 2026-08-21
library: SAIF.Business.View.Policy
reference_type: embedded
---

# clsPolicySecurity

`clsPolicySecurity` is the central **authorization** class in this library: it determines whether
the current `clsSecurityPrincipal` may view a given policy ([Determine whether the current user may view a policy](../../operations/determine-policy-access.md))
and produces the "policy list" (book of business) for agents, policyholders, groups, loss-control
consultants, and fee auditors ([Build the current user's book of business](../../operations/build-book-of-business.md)).
Unlike most other types in this library, it is a plain class, not a `clsBusinessBase` derivative.

## Purpose
- Enforces per-user-type policy access rules ([BR-VP-002](../../business-rules.md#br-vp-002-secure-policy-ad-resource-gate) through [BR-VP-009](../../business-rules.md#br-vp-009-fee-auditor-vendor-policy-audit-record-match-required)).
- Builds the "book of business" policy list for the current user, dispatching by user type to different SQL Server, Oracle, or in-memory sources.
- Constructs and owns a secondary SQL Server "BDS" `IDataPortalInfo` connection, distinct from the caller-supplied primary DPI, used exclusively for group/loss-control/agent authorization lookups.

## Context
- Namespace: `SAIF.Business.View.Policy`
- Assembly/package: `SAIF.Business.View.Policy` (embedded library reference)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `New` | `Sub New(inSecurityPrincipal As clsSecurityPrincipal, inDPI As IDataPortalInfo)` | Constructs the security manager, deriving a `clsUserType` and initializing the secondary SQL Server BDS connection. |
| `IsPolicyValidForUser` | `Function IsPolicyValidForUser(inPolicyData As clsPolicyData) As Boolean` | The core authorization entry point ([Determine whether the current user may view a policy](../../operations/determine-policy-access.md)). |
| `IsPolicyValidForUser` | `Function IsPolicyValidForUser(inPolicyNum As Decimal) As Boolean` | Convenience overload that loads the policy header before delegating to the object overload. |
| `IsPolicyValidForParentPolicy` | `Function IsPolicyValidForParentPolicy(inPolicyNum As Decimal) As Boolean` | Policyholder-specific ownership/parent-affiliation check ([BR-VP-006](../../business-rules.md#br-vp-006-policyholder-ownership-affiliation-match-required)). |
| `IsInGroup` | `Function IsInGroup(...) As Boolean` | Group-membership check via [SQL-VP-033](../../sql/SQL-033-isingroup.md). |
| `CanSafetyConsultantAccessPolicy` | `Function CanSafetyConsultantAccessPolicy(...) As Boolean` | Loss-control consultant team-assignment match check. |
| `CanAuditorAccessPolicy` | `Function CanAuditorAccessPolicy(...) As Boolean` | Fee-auditor vendor/audit-record match check via [SQL-VP-037](../../sql/SQL-037-canauditoraccesspolicy.md). |
| `PolicyList` | `ReadOnly Property PolicyList As List(Of strPolicyList)` | Lazily builds and caches the current user's book of business ([Build the current user's book of business](../../operations/build-book-of-business.md)). |
| `GetPolicyListForAgent` | `Function GetPolicyListForAgent(...) As List(Of strPolicyList)` | Agent book-of-business builder via [SQL-VP-036](../../sql/SQL-036-getpolicylistforagent.md). |
| `GetPolicyListforGroup` | `Function GetPolicyListforGroup() As List(Of strPolicyList)` | Group book-of-business builder via [SQL-VP-034](../../sql/SQL-034-getpolicylistforgroup.md). |
| `GetPolicyListForSafetyConsultant` | `Function GetPolicyListForSafetyConsultant(...) As List(Of strPolicyList)` | Loss-control book-of-business builder via [SQL-VP-035](../../sql/SQL-035-getpolicylistforsafetyconsultant.md). |
| `GetPolicyListForFeeAuditor` | `Function GetPolicyListForFeeAuditor(...) As List(Of strPolicyList)` | Fee-auditor book-of-business builder via [SQL-VP-038](../../sql/SQL-038-getauditorpolicylistsql.md). |
| `DPISql` | `ReadOnly Property DPISql As IDataPortalInfo` | The internally-constructed secondary SQL Server BDS connection. |

## Behavioral notes
- Not a `clsBusinessBase` derivative — this class has no inherited members from `saif.framework.core`'s business-object base classes.
- Any user type not matched by the `IsPolicyValidForUser` `Select Case` falls through to an implicit deny (`hasAccess` remains `False`).*
- The `PolicyList` property has no dispatch case for `SaifEmployee`/`MCO`/`MedProv`/`Bookkeeper`; these user types do not receive a book-of-business list from this property.*

## Constraints and usage notes
- The secondary SQL Server BDS connection is built from three Environment API settings (`BDS_USER`, `bdsDatabase`, `BDS_DATABASENAME`) read once per instance in `Initialize()` ([Configuration settings](../../configuration.md)).
- `PolicyList` results are cached for the lifetime of the `clsPolicySecurity` instance; construct a new instance to force a re-query.

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `SAIF.Business.View.Policy\clsPolicySecurity.vb`