---
title: Recompute per-claim access flags
summary: Translate claim sensitivity attributes and AD resource membership into four boolean access flags.
status: draft
owner: SAIF Documentation Generator
last_reviewed: 2026-08-21
library: SAIF.Application.Claim
reference_type: embedded
operation_id: OP-CLM-3
trigger: Called from claim access evaluation, or directly by a consumer.
---

# Recompute per-claim access flags

This operation is the composite confidentiality evaluator: it resets each of the four access flags to permissive and denies only the dimensions a specific claim actually triggers.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-CLM-3 |
| **Trigger** | `ClaimAppManager.OnCheckSecurity` (step 1), or a direct call by a consumer |
| **Inputs** | `clsClaimData` |
| **Outputs** | Four boolean access flags (`ConflictAccess`, `ExposureAccess`, `HealthIssueAccess`, `SecureClaimAccess`) |
| **Primary components** | `ClaimSecurity.CheckClaim` |
| **Entry point** | `SAIF.Application.Claim/ClaimSecurity.vb` |

## Steps

Each flag is reset to `True` before evaluation — a permissive default.

1. `m_ConflictAccess = False` when `inClaim.IsWorkerConflict` and `Not UserAccess.ConflictAccess` ([BR-CLM-007](../business-rules.md#br-clm-007-conflict-claim-access-flag)).
2. `m_ExposureAccess = False` when `inClaim.IsExposure` and `Not UserAccess.ExposureAccess` ([BR-CLM-008](../business-rules.md#br-clm-008-exposure-claim-access-flag)).
3. `m_HealthIssueAccess = False` when `inClaim.IsHealthIssue` and `inClaim.IsExposure` and `Not UserAccess.ExposureAccess` — the health-issue flag is gated on the exposure resource and the claim also being an exposure claim; the `CollateralHealthClaim` resource exposed by `ClaimUserAccess.HealthIssueAccess` is never consulted here ([BR-CLM-009](../business-rules.md#br-clm-009-health-issue-access-flag)).
4. `m_SecureClaimAccess = False` when `inClaim.IsHostileWorker` and `Not UserAccess.SecureClaimAccess` ([BR-CLM-010](../business-rules.md#br-clm-010-secure-claim-access-flag)).
   - Delegated logic: each `UserAccess.*Access` property calls the inherited `UserAccess.HasAccess(resourceName)`, which returns a cached decision or calls `clsSecurityPrincipal.IsAuthorized(resourceName)` and caches it per lower-cased name. Whether `IsAuthorized` performs an AD lookup or a WCF SecurityService call is implemented in `SAIF.BOF.Framework`.**
   > **Origin**: The AD-membership resolution behind each `UserAccess.*Access` property is implemented in `SAIF.Application` (`UserAccess.HasAccess`) and `SAIF.BOF.Framework.Security` (`clsSecurityPrincipal.IsAuthorized`), and executed on behalf of this operation.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([CheckClaim called]) --> Reset[Reset all four flags to True]
	Reset --> Conflict{"IsWorkerConflict and not<br>ConflictAccess?"}
	Conflict -->|Yes| DenyConflict[ConflictAccess = False]
	Conflict -->|No| Exposure{"IsExposure and not<br>ExposureAccess?"}
	DenyConflict --> Exposure
	Exposure -->|Yes| DenyExposure[ExposureAccess = False]
	Exposure -->|No| Health{"IsHealthIssue and IsExposure<br>and not ExposureAccess?"}
	DenyExposure --> Health
	Health -->|Yes| DenyHealth[HealthIssueAccess = False]
	Health -->|No| Hostile{"IsHostileWorker and not<br>SecureClaimAccess?"}
	DenyHealth --> Hostile
	Hostile -->|Yes| DenySecure[SecureClaimAccess = False]
	Hostile -->|No| Done([Return four flags])
	DenySecure --> Done
```

## Failure and edge-case behavior

- A claim whose sensitivity flags are all false is fully accessible to any authenticated user (fail-open default).
- The `CollateralHealthClaim` AD resource, exposed via `ClaimUserAccess.HealthIssueAccess`, is never consulted by this operation; whether this is intentional narrowing or a defect is unknown.**

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Application.Claim/ClaimSecurity.vb`
- `SAIF.Application.Claim/ClaimUserAccess.vb`