---
title: SAIF.Application.Claim.Legal security and authorization
summary: Authorization requirements, AD resources, and data-level access control.
status: draft
owner: SAIF Documentation Generator
last_reviewed: 2026-08-21
library: SAIF.Application.Claim.Legal
reference_type: embedded
---

# SAIF.Application.Claim.Legal security and authorization

This page documents authorization mechanisms implemented or consumed by this library. The code relies on an injected `clsSecurityPrincipal` and inherited claim-security services rather than direct LDAP or attribute-based authorization.

## Authorization architecture

The library exposes programmatic `IsAuthorized` checks on managers, then applies claim-level gating in `LegalManagerBase.OnRetrieve` and search-parameter scoping in `clsCaseSearchManager.GetSearchResults`.

```mermaid
flowchart TD
  Caller[UI caller] --> Manager[Legal manager]
  Manager --> Principal[clsSecurityPrincipal]
  Principal --> AD["Active Directory resource<br>check"]
  Manager --> Claim[ClaimData / ClaimSecurity]
  Claim --> Gate[Claim or search gating]
```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `LNAdmin` | LegalNet administrator. Grants unconditional claim-view access, bypassing the conflict and exposure confidentiality gates | `LegalManagerBase.IsInAdminGroup (property); consumed by LegalManagerBase.OnRetrieve` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb:240-248, consumed at :329` |
| `LNCaseUpdate` | Permission to update legal case data | `LegalManagerBase.IsInCaseUpdateGroup (property)` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb:249-257` |
| `LNView` | View-only access to LegalNet | `LegalManagerBase.IsInViewOnly (property)` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb:258-266` |
| `LNConflict` | Access to claims flagged as **worker conflict** (confidential) | `LegalManagerBase.HasLegalConflictAccess (Protected Friend property, constant LEGALCONFLICTSECURITYKEY); consumed by LegalManagerBase.OnRetrieve` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb:9, :34-38, consumed at :338` |
| `LNExposure` | Access to claims flagged as **exposure** (confidential health-issue claims) | `LegalManagerBase.HasLegalExposureAccess (Protected Friend property, constant LEGALEXPOSURESECURITYKEY); consumed by LegalManagerBase.OnRetrieve` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb:10, :39-43, consumed at :341` |
| `LNNoteView` | Permission to view legal case notes | `clsCaseNotesManager.IsInNoteView (property)` | `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb:34-42` |
| `LNUpdate` | Permission to update bill notes on a legal case | `clsCaseNotesManager.CanUpdateBillNotes (property)` | `SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb:43-51` |
| `LNLCEUpdate` | Permission to update Legal Case Evaluation (LCE) records | `clsScheduleManager.IsInLCEUpdateGroup (property)` | `SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb:38-46` |
| `LNDueDateUpdate` | Permission to update the LCE due date | `clsScheduleManager.IsInLCEDueDateGroup (property)` | `SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb:47-55` |

## Authorization enforcement points

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `LegalManagerBase` | `HasLegalConflictAccess` | `LNConflict` | `IsAuthorized` | `LegalManagerBase.vb:36` |
| `LegalManagerBase` | `HasLegalExposureAccess` | `LNExposure` | `IsAuthorized` | `LegalManagerBase.vb:41` |
| `LegalManagerBase` | `IsInAdminGroup` | `LNAdmin` | `IsAuthorized` | `LegalManagerBase.vb:242` |
| `LegalManagerBase` | `IsInCaseUpdateGroup` | `LNCaseUpdate` | `IsAuthorized` | `LegalManagerBase.vb:251` |
| `LegalManagerBase` | `IsInViewOnly` | `LNView` | `IsAuthorized` | `LegalManagerBase.vb:260` |
| `clsCaseNotesManager` | `IsInNoteView` | `LNNoteView` | `IsAuthorized` | `clsCaseNotesManager.vb:36` |
| `clsCaseNotesManager` | `CanUpdateBillNotes` | `LNUpdate` | `IsAuthorized` | `clsCaseNotesManager.vb:45` |
| `clsScheduleManager` | `IsInLCEUpdateGroup` | `LNLCEUpdate` | `IsAuthorized` | `clsScheduleManager.vb:40` |
| `clsScheduleManager` | `IsInLCEDueDateGroup` | `LNDueDateUpdate` | `IsAuthorized` | `clsScheduleManager.vb:49` |

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Claim | `LegalManagerBase.OnRetrieve` | Conflict/exposure gating plus override path | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| Legal case search result | `clsCaseSearchManager.GetSearchResults` | `ExposureCode` and `ConflictAccess` scoping before search execution | `SAIF.Application.Claim.Legal\LegalNet\clsCaseSearchManager.vb` |

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `clsSecurityPrincipal` | Authorization principal used by every `LN*` check. | All managers via `LegalManagerBase.New(inDatabase, inSecurityPrincipal)` | `SAIF.Application.Claim.Legal\LegalManagerBase.vb` |
| `ClaimSecurity` | Inherited claim-domain security helper used during retrieve and search gating. | `LegalManagerBase`, `clsCaseSearchManager` | `SAIF.Application.Claim\ClaimAppManager.vb`; `SAIF.Application.Claim.Legal\LegalNet\clsCaseSearchManager.vb` |

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [Procedures](procedures/index.md)
- [API reference](api/index.md)

## Sources
- SAIF.Application.Claim.Legal\LegalManagerBase.vb
- SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
- SAIF.Application.Claim.Legal\LegalNet\clsCaseSearchManager.vb
- SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb
- SAIF.Application.Claim\ClaimAppManager.vb