---
title: AppManagerBase.AppSecurityRole
summary: API reference for AppManagerBase.AppSecurityRole.
status: draft
owner: SAIF Documentation
last_reviewed: 2026-08-21
library: SAIF.Application
reference_type: embedded
---

# AppManagerBase.AppSecurityRole

`AppManagerBase.AppSecurityRole` is the nested enum actually bound to `AppManagerBase.SecurityRole` and derived through the `Is*` properties (`IsAccessible`, `IsRestricted`, `IsUpdateable`, `IsViewOnly`). It defines the tri-state, mutually exclusive access classification ([BR-APP-003](../../business-rules.md#br-app-003-access-classification-is-mutually-exclusive-and-read-only-externally)) that every UI capability decision across the manager hierarchy ultimately reads.

## Purpose
- Represents the single access-classification value a manager instance can hold at one time: `NoAccess`, `ViewOnly`, or `Update`.
- Backs the deny-by-default posture: manager instances start at `NoAccess` until an explicit `Mark*` call changes the classification ([BR-APP-002](../../business-rules.md#br-app-002-access-is-denied-by-default)).

## Context
- Namespace: `SAIF.Application` (nested inside `AppManagerBase`)
- Assembly/package: `SAIF.Application` (embedded, ProjectReference)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `NoAccess` | Enum member | Deny-by-default state; the initial value of every manager instance. |
| `ViewOnly` | Enum member | Read-only access granted by a derived manager's `MarkViewOnly()` call. |
| `Update` | Enum member | Write access granted by a derived manager's `MarkUpdate()` call. |

## Behavioral notes
- This is the enum `AppManagerBase.SecurityRole` actually returns; the top-level [AppSecurityRole](AppSecurityRole.md) enum in `Enums.vb` is a separate, unreferenced duplicate.*

## Constraints and usage notes
- Values are set only through `AppManagerBase.MarkUpdate()` / `MarkViewOnly()` / `MarkNoAccess()`; there is no public setter on `SecurityRole`.

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with `**` could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Application/AppManagerBase.vb`