---
title: SAIF.Application.Claim security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control.
status: draft
owner: SAIF Documentation Generator
last_reviewed: 2026-08-21
library: SAIF.Application.Claim
reference_type: embedded
---

# SAIF.Application.Claim security and authorization

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a `clsSecurityPrincipal` on construction.

## Authorization architecture

Authorization is centralized and delegated: AD resource-name membership resolution is entirely inherited (`UserAccess.HasAccess` / `clsSecurityPrincipal.IsAuthorized`) from `SAIF.BOF.Framework.Security`. `SAIF.Application.Claim` contributes only the claim-domain resource vocabulary (`ClaimUserAccess`) and the per-claim composition logic (`ClaimSecurity`), which `ClaimAppManager.OnCheckSecurity` converts into the coarse `AppSecurityRole` used by the rest of the solution.

```mermaid
flowchart TD
    Caller[Derived claim manager / UI] --> Manager[ClaimAppManager.OnCheckSecurity]
    Manager --> ClaimSec[ClaimSecurity.CheckClaim]
    ClaimSec --> UserAccess[ClaimUserAccess.HasAccess]
    UserAccess --> Principal[clsSecurityPrincipal.IsAuthorized]
    Manager --> Override[CheckForSecurityOverride]
    Override --> ClaimServices[ClaimServices.HasOverrideAcess]
    ClaimServices --> DB[(Claim database - ClaimDPI)]
```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `SecureClaim` | Grants the user the right to view claims flagged as hostile-worker ("secure") claims | `ClaimSecurity.CheckClaim` (hostile-worker branch) | `SAIF.Application.Claim/ClaimUserAccess.vb` |
| `ConflictClaim` | Grants the user the right to view worker-conflict claims (SAIF employees/relatives) | `ClaimSecurity.CheckClaim`; enforced by `ClaimAppManager.OnCheckSecurity` | `SAIF.Application.Claim/ClaimUserAccess.vb` |
| `ExposureClaim` | Grants the user the right to view occupational-exposure claims | `ClaimSecurity.CheckClaim` (exposure and health-issue evaluation) | `SAIF.Application.Claim/ClaimUserAccess.vb` |
| `CollateralHealthClaim` | Intended to grant the right to view collateral health-issue claims | Exposed on the public surface via `ClaimUserAccess.HealthIssueAccess` but **not** consulted by `ClaimSecurity.CheckClaim`; no in-repository consumer found** | `SAIF.Application.Claim/ClaimUserAccess.vb` |

Fully-qualified production group names are expected to be `SAIF\<ResourceName>Resource`, with `...TestResource` variants in non-production; the environment suffix is appended downstream by `clsSecurityPrincipal.IsAuthorized`.*

## Authorization enforcement points

### Attribute-based authorization

None. This is a VB.NET class library with no controllers and no `SAIFAuthorize`/`SaifAuthorize` usage. Attribute-based authorization, if present in this solution, belongs to the hosting `LegalMaintenance` web application, not to this library.

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `ClaimUserAccess` | `SecureClaimAccess` | `SecureClaim` | `HasAccess` | `SAIF.Application.Claim/ClaimUserAccess.vb` |
| `ClaimUserAccess` | `ConflictAccess` | `ConflictClaim` | `HasAccess` | `SAIF.Application.Claim/ClaimUserAccess.vb` |
| `ClaimUserAccess` | `ExposureAccess` | `ExposureClaim` | `HasAccess` | `SAIF.Application.Claim/ClaimUserAccess.vb` |
| `ClaimUserAccess` | `HealthIssueAccess` | `CollateralHealthClaim` | `HasAccess` (no internal consumer — dead decision surface) | `SAIF.Application.Claim/ClaimUserAccess.vb` |
| `ClaimUserAccess` | `New(inSecurityPrincipal, ParamArray AccessRights())` | caller-supplied resource array | `CheckAccess` (bulk pre-resolution; not called anywhere in this library) | `SAIF.Application.Claim/ClaimUserAccess.vb` |
| `ClaimSecurity` | `CheckClaim` | Combines claim sensitivity flags with `ConflictClaim`/`ExposureClaim`/`SecureClaim` | Composite | `SAIF.Application.Claim/ClaimSecurity.vb` |
| `ClaimAppManager` | `OnCheckSecurity` | `ClaimSecurity.CheckClaim` + `CheckForSecurityOverride` | `MarkViewOnly`/`MarkNoAccess` gate ([BR-CLM-006](business-rules.md#br-clm-006-conflict-claim-denial-with-override)) | `SAIF.Application.Claim/ClaimAppManager.vb` |
| `ClaimAppManager` | `CheckForSecurityOverride` | Database override lookup | `ClaimServices.HasOverrideAcess(DPI, ClaimID, user)` | `SAIF.Application.Claim/ClaimAppManager.vb` |
| `ClaimAppManager` | `OnValidContext` | `SecurityRole = AppSecurityRole.NoAccess` | Secondary gate — blocks `Retrieve()` | `SAIF.Application.Claim/ClaimAppManager.vb` |

**9 programmatic enforcement points** (7 active decision/gate points, excluding the unused `HealthIssueAccess` accessor and the unused bulk constructor). **0 attribute-based.**

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Claim (`clsClaimData`) | `ClaimSecurity.CheckClaim(inClaim)` | Combines claim-record sensitivity flags (`IsWorkerConflict`, `IsExposure`, `IsHealthIssue`, `IsHostileWorker`) with the corresponding AD resource verdict; the same user's verdict differs claim-by-claim based on data stored on the claim row | `SAIF.Application.Claim/ClaimSecurity.vb` |
| Claim ↔ user override record | `ClaimAppManager.CheckForSecurityOverride()` | `ClaimServices.HasOverrideAcess(DPI, ClaimID, user)` — an out-of-band exception list keyed on the (claim, user) pair that supersedes the `ConflictClaim` AD denial; the backing SQL/table lives in `SAIF.BOF.Business.View.Claim` and was not resolvable here** | `SAIF.Application.Claim/ClaimAppManager.vb` |

No ownership-style validation (`IsValidPolicyForCurrentUser`, `ValidateOwnership`) exists in this library — access is claim-sensitivity-driven, not claimant-ownership-driven.

## Segregation of duties

None found. No `*SegregationOfDuties*`/`*SOD*` type and no mutually-exclusive-privilege rule appears in this library; the four resources are independent grants with no declared conflicts between them.

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `clsSecurityPrincipal` | Pre-authenticated identity carrier supplied by constructor injection at every entry point | `ClaimAppManager.New`, `ClaimSecurity.New`, `ClaimUserAccess.New` | `SAIF.Framework.Security` (`SAIF.BOF.Framework` package)† |
| `UserAccess` (base class) | Resource-membership cache and AD lookup contract | `ClaimUserAccess` | `SAIF.Application` (this repository) |
| `ClaimUserAccess` | Claim-domain AD resource vocabulary and membership accessor | `ClaimSecurity` | `SAIF.Application.Claim/ClaimUserAccess.vb` |
| `ClaimSecurity` | Per-claim composite access evaluator | `ClaimAppManager`, `SAIF.Application.Claim.Legal/LegalManagerBase.vb`, `SAIF.Application.Claim.Legal/LegalNet/clsCaseSearchManager.vb` | `SAIF.Application.Claim/ClaimSecurity.vb` |

No `ISecurityManager`, `SecurityServiceClient`, `PrincipalContext`, `GroupPrincipal`, `DirectorySearcher`, or LDAP filter appears in this library; any WCF SecurityService hop occurs inside `clsSecurityPrincipal.IsAuthorized`, which is framework-internal and unknown from this repository.**

## Notes
- **Fail-open by default.** All four `ClaimSecurity` access flags initialize to `True` and are reset to `True` at the top of each `CheckClaim` branch; a claim whose sensitivity flags are all false is fully accessible to any authenticated user.
- Only the conflict dimension blocks access automatically ([BR-CLM-012](business-rules.md#br-clm-012-only-conflict-dimension-auto-blocks)); exposure, hostile-worker, and health-issue restrictions are advisory and must be enforced by each consuming manager — `SAIF.Application.Claim.Legal/LegalManagerBase.vb` and `SAIF.Application.Claim.Legal/LegalNet/clsCaseSearchManager.vb` do so for the exposure dimension.*
- `ClaimSecurity` and `ClaimUserAccess` are both `<Serializable()>`; a persisted instance could carry stale AD verdicts across a group-membership change.*
- `ClaimSecurity.m_HasAccessToClaim` is declared and initialized but never read or written — dead security state.**
- AD resource names listed here use base names only. The framework appends `Resource` (production) or `TestResource` (non-production) at runtime.
- Whether `ClaimServices.HasOverrideAcess` queries a claim-override table, an AD group, or a cached list could not be determined from this repository.**

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified. Statements marked with
> † were retrieved from dependency library documentation via the Legends CLI RAG service. They
> describe inherited behavior from the indicated origin library and should be verified if the
> dependency version changes.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [API reference](api/index.md)

## Sources
- `SAIF.Application.Claim/ClaimUserAccess.vb`
- `SAIF.Application.Claim/ClaimSecurity.vb`
- `SAIF.Application.Claim/ClaimAppManager.vb`
- `SAIF.Application.Claim/ClaimAppConstants.vb`
- `SAIF.Application.Claim.Legal/LegalManagerBase.vb`
- `SAIF.Application.Claim.Legal/LegalNet/clsCaseSearchManager.vb`