---
title: Evaluate claim access
summary: Evaluate confidentiality access for the current claim and set the coarse security role.
status: draft
owner: SAIF Documentation Generator
last_reviewed: 2026-08-21
library: SAIF.Application.Claim
reference_type: embedded
operation_id: OP-CLM-2
trigger: Invoked from ChangeContext after a claim is loaded.
---

# Evaluate claim access

This operation converts per-claim confidentiality flags into the coarse security role every claim manager relies on, applying the only hard-blocking rule this library enforces directly.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-CLM-2 |
| **Trigger** | Invoked only from `ChangeContext()` |
| **Inputs** | `ClaimData`, `SecurityPrincipal` |
| **Outputs** | `ClaimSecurity` flags, `AppSecurityRole`, denial `Message` |
| **Primary components** | `ClaimAppManager.OnCheckSecurity`, `ClaimAppManager.CheckForSecurityOverride`, `ClaimAppManager.ConfidentialAccessDeniedMessage` |
| **Entry point** | `SAIF.Application.Claim/ClaimAppManager.vb` |

## Steps

1. `ClaimSecurity.CheckClaim(ClaimData)` lazily constructs `ClaimSecurity(SecurityPrincipal)` on first access, then recomputes the four access flags ([BR-CLM-007](../business-rules.md#br-clm-007-conflict-claim-access-flag), [BR-CLM-008](../business-rules.md#br-clm-008-exposure-claim-access-flag), [BR-CLM-009](../business-rules.md#br-clm-009-health-issue-access-flag), [BR-CLM-010](../business-rules.md#br-clm-010-secure-claim-access-flag)) — see [Recompute per-claim access flags](recompute-access-flags.md).
2. `MarkViewOnly()` is called unconditionally; every claim context starts at view-only ([BR-CLM-005](../business-rules.md#br-clm-005-view-only-by-default)).
3. If `Not ClaimSecurity.ConflictAccess` and `Not CheckForSecurityOverride()`, call `MarkNoAccess()` and set `Message = ConfidentialAccessDeniedMessage` ([BR-CLM-006](../business-rules.md#br-clm-006-conflict-claim-denial-with-override)).
   - `CheckForSecurityOverride()` calls `ClaimServices.HasOverrideAcess(DPI, ClaimData.ClaimID, SecurityPrincipal.UserName.ToString)` — a per-claim, per-user override grant lookup.
     - Delegated logic: implemented in `SAIF.BOF.Business.View.Claim`; SQL and tables were not traced in this pass.**
     > **Origin**: The security-override lookup is implemented in `SAIF.BOF.Business.View.Claim` (`ClaimServices.HasOverrideAcess`) and executed on behalf of this operation.
4. `ConfidentialAccessDeniedMessage` composes "Please contact `<AdjusterName>` at `<AdjusterPhone>` for claim information." when the claim carries an adjuster first name, otherwise returns `ClaimAppConstants.ERRORCONFIDENTIALCLAIM` ([BR-CLM-011](../business-rules.md#br-clm-011-confidential-access-denial-referral)).
5. Only the conflict flag gates access here; exposure, hostile-worker, and health-issue flags are computed but not enforced by this library ([BR-CLM-012](../business-rules.md#br-clm-012-only-conflict-dimension-auto-blocks)).

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([OnCheckSecurity]) --> Check[ClaimSecurity.CheckClaim]
	Check --> ViewOnly[MarkViewOnly]
	ViewOnly --> ConflictTest{ConflictAccess?}
	ConflictTest -->|True| Allowed([View-only access granted])
	ConflictTest -->|False| Override{Security override granted?}
	Override -->|Yes| Allowed
	Override -->|No| Denied(["MarkNoAccess + denial<br>message"])
```

## Failure and edge-case behavior

- Exposure, hostile-worker, and health-issue denials are advisory only; a consuming manager that does not re-test them silently bypasses those controls.*
- `OnCheckSecurity` dereferences `ClaimData` without a null guard; reachability of a null `ClaimData` here is unknown.**

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Application.Claim/ClaimAppManager.vb`
- `SAIF.Application.Claim/ClaimAppConstants.vb`