---
title: ClaimSecurity
summary: API reference for ClaimSecurity.
status: draft
owner: SAIF Documentation Generator
last_reviewed: 2026-08-21
library: SAIF.Application.Claim
reference_type: embedded
---

# ClaimSecurity

`ClaimSecurity` is the per-claim confidentiality evaluator: it combines a claim's sensitivity attributes (worker-conflict, exposure, health-issue, hostile-worker) with the current user's AD resource membership into four independent boolean access flags. It implements a fail-open model — every flag defaults to `True` and is denied only when a claim explicitly triggers the corresponding sensitivity attribute and the user lacks the matching resource.

## Purpose
- Recomputes the four claim-confidentiality access flags for a specific claim via `CheckClaim` ([BR-CLM-007](../../business-rules.md#br-clm-007-conflict-claim-access-flag), [BR-CLM-008](../../business-rules.md#br-clm-008-exposure-claim-access-flag), [BR-CLM-009](../../business-rules.md#br-clm-009-health-issue-access-flag), [BR-CLM-010](../../business-rules.md#br-clm-010-secure-claim-access-flag)).
- Owns the underlying `ClaimUserAccess` accessor used to resolve AD resource membership for the current user.
- Consumed by `ClaimAppManager.OnCheckSecurity` (which enforces only the conflict flag) and by `SAIF.Application.Claim.Legal/LegalManagerBase.vb`/`clsCaseSearchManager.vb`, which re-test the exposure flag themselves.

## Context
- Namespace: `SAIF.Application.Claim`
- Assembly/package: `SAIF.Application.Claim` (embedded, ProjectReference)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `New(inUserAccess)` | `Public Sub New(inUserAccess As ClaimUserAccess)` | Binds an already-constructed AD resource accessor. |
| `New(inPrincipal)` | `Public Sub New(inPrincipal As clsSecurityPrincipal)` | Builds a `ClaimUserAccess` from the supplied principal and binds it. |
| `UserAccess` | `Public ReadOnly Property As ClaimUserAccess` | The underlying AD resource accessor consulted by `CheckClaim`. |
| `ConflictAccess` | `Public ReadOnly Property As Boolean` | `False` only when the claim is a worker-conflict claim and the user lacks `ConflictClaim`; the only flag `ClaimAppManager.OnCheckSecurity` enforces as a hard block ([BR-CLM-007](../../business-rules.md#br-clm-007-conflict-claim-access-flag)). |
| `ExposureAccess` | `Public ReadOnly Property As Boolean` | `False` only when the claim is an exposure claim and the user lacks `ExposureClaim`; enforcement is left to consumers ([BR-CLM-008](../../business-rules.md#br-clm-008-exposure-claim-access-flag)). |
| `SecureClaimAccess` | `Public ReadOnly Property As Boolean` | `False` only when the claim has a hostile worker and the user lacks `SecureClaim`; enforcement is left to consumers ([BR-CLM-010](../../business-rules.md#br-clm-010-secure-claim-access-flag)). |
| `HealthIssueAccess` | `Public ReadOnly Property As Boolean` | `False` only when the claim is both a health-issue and exposure claim and the user lacks `ExposureClaim`; the `CollateralHealthClaim` resource is never consulted ([BR-CLM-009](../../business-rules.md#br-clm-009-health-issue-access-flag)). |
| `CheckClaim(inClaim)` | `Public Sub CheckClaim(inClaim As clsClaimData)` | Recomputes all four access flags against the supplied claim, resetting every flag to permissive first. |

## Behavioral notes
- Only `ConflictAccess` is tested by `ClaimAppManager.OnCheckSecurity`; `ExposureAccess`, `SecureClaimAccess`, and `HealthIssueAccess` are computed but advisory — a consumer that does not re-test them silently bypasses those controls ([BR-CLM-012](../../business-rules.md#br-clm-012-only-conflict-dimension-auto-blocks)).
- Fail-open default: a claim whose sensitivity flags are all false is fully accessible to any authenticated user.
- A private field `m_HasAccessToClaim` is declared and initialized to `False` but never read or written elsewhere — dead state.**
- This type is `<Serializable()>`, so a resolved verdict can cross app-domain/session boundaries and could become stale if serialized across an AD group-membership change.*

## Constraints and usage notes
- Consumers that need to enforce exposure, hostile-worker, or health-issue restrictions (e.g. `SAIF.Application.Claim.Legal/LegalManagerBase.vb`) must explicitly test the corresponding flag themselves; this type does not block access on their behalf.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Application.Claim/ClaimSecurity.vb`