---
title: SAIF.Application operations and processes
summary: Business and technical operations supported by this library.
status: draft
owner: SAIF Documentation
last_reviewed: 2026-08-21
library: SAIF.Application
reference_type: embedded
---

# SAIF.Application operations and processes

This page is the operation catalog for this library. `SAIF.Application` supports no domain workflow of its own; each row below describes a reusable application-layer process that domain managers (`SAIF.Application.Claim`, `SAIF.Application.Claim.Legal`) build on.

## Operation catalog
| Operation | Intent | Trigger | Inputs | Outputs | Rules |
| --- | --- | --- | --- | --- | --- |
| [Construct and initialize an application manager](operations/construct-and-initialize-an-application-manager.md) | Bind an identity to a new manager instance and prepare its data layer | A derived manager (e.g. `ClaimAppManager`) is constructed by a front-end page or service caller | `inSecurityPrincipal As clsSecurityPrincipal` | An initialized manager instance with a data layer ready for portal creation | [BR-APP-001](business-rules.md#br-app-001-manager-construction-requires-a-security-principal), [BR-APP-002](business-rules.md#br-app-002-access-is-denied-by-default), [BR-APP-007](business-rules.md#br-app-007-database-client-identity-is-the-requesting-user-unless-overridden) |
| [Provision a data portal and register it by key](operations/provision-a-data-portal-and-register-it-by-key.md) | Build an Oracle or SQL Server data portal and register it under a caller-supplied key | Derived manager's `OnCreateDataLayer()` implementation | `DBUser`, `Database`, `Server`, `BatchID` properties; a portal key string | An `IDataPortalInfo` registered in the DPI library under the lower-cased key | [BR-APP-007](business-rules.md#br-app-007-database-client-identity-is-the-requesting-user-unless-overridden), [BR-APP-008](business-rules.md#br-app-008-a-dpi-key-is-bound-to-exactly-one-portal) |
| [Evaluate and cache AD resource access](operations/evaluate-and-cache-ad-resource-access.md) | Answer whether the current user holds a named AD resource, reusing prior answers | A derived access class (e.g. `ClaimUserAccess`) is asked whether the current user holds a named AD resource | One or more AD resource names; a `clsSecurityPrincipal` previously supplied via `SetPrincipal` | `Boolean` authorization result; a populated per-instance cache | [BR-APP-004](business-rules.md#br-app-004-ad-resource-authorization-is-cached-per-instance) |
| [Accumulate and render user messages](operations/accumulate-and-render-user-messages.md) | Build a single de-duplicated, channel-appropriate message string for the caller | A derived manager reports a validation failure, save result, or informational note | One message string, a `String()`, or an `IEnumerable(Of String)` | The `Message` property (single concatenated string) | [BR-APP-005](business-rules.md#br-app-005-duplicate-message-text-is-never-shown-twice), [BR-APP-010](business-rules.md#br-app-010-messages-render-with-a-channel-appropriate-defaulted-separator) |
| [Retrieve / Write lifecycle contract](operations/retrieve-write-lifecycle-contract.md) | Define the read/write contract every concrete manager must implement | Front-end page load or save postback on a derived manager | Derived-class context state | `Boolean` success flag; `Message` text; persisted business objects | [BR-APP-003](business-rules.md#br-app-003-access-classification-is-mutually-exclusive-and-read-only-externally), [BR-APP-006](business-rules.md#br-app-006-a-write-must-be-bracketed-by-an-explicit-transaction) |
| [Build a service response](operations/build-a-service-response.md) | Accumulate categorized success/warning/error/environment messages for service-style callers | A service-style manager derived from `clsServiceAppManagerBase` completes a unit of work | Messages added during processing; optionally a caught `Exception` | `Result` flag plus categorized message collections | [BR-APP-009](business-rules.md#br-app-009-service-responses-succeed-until-declared-otherwise-exceptions-are-environmental) |

## Process flow diagram
The following diagram visualizes the manager construction, authorization, and message-accumulation flow shared by all operations above.

```mermaid
flowchart TD
	Start([Derived manager constructed]) --> Bind[Bind clsSecurityPrincipal]
	Bind --> Init["Initialize: OnInitialize<br>then OnCreateDataLayer"]
	Init --> Provision["Provision data portal via<br>ApplicationDataAccess"]
	Init --> Auth["UserAccess.HasAccess checks<br>AD resource"]
	Auth --> Cache{Cached?}
	Cache -->|Yes| Return[Return cached Boolean]
	Cache -->|No| Query[clsSecurityPrincipal.IsAuthorized]
	Query --> Return
	Return --> Mark["Derived manager calls<br>MarkUpdate / MarkViewOnly /<br>MarkNoAccess"]
	Mark --> RW[Retrieve / Write lifecycle]
```

## Database interactions

No database interactions exist in this library — `SAIF.Application` provisions Oracle and SQL Server data portals but issues no SQL of its own; the SQL executed on those portals belongs to consuming `SAIF.Business.*` libraries.

## Failure and edge-case behavior
- A `Nothing`/uninitialized `clsSecurityPrincipal` surfaces as a `NullReferenceException` rather than an explicit deny ([Construct and initialize an application manager](operations/construct-and-initialize-an-application-manager.md), [Evaluate and cache AD resource access](operations/evaluate-and-cache-ad-resource-access.md)).**
- Re-registering a DPI key through `CreateOraclePortal` / `CreateSQLServerPortal` raises `ArgumentException`; the same key via `InjectDPI` is silently ignored ([Provision a data portal and register it by key](operations/provision-a-data-portal-and-register-it-by-key.md)).
- `ServiceResponse.ProcessException` can loop indefinitely when an exception's inner-exception chain is non-`Nothing`, due to an inner-exception re-assignment defect ([Build a service response](operations/build-a-service-response.md)).**

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `SAIF.Application/AppManagerBase.vb`
- `SAIF.Application/UserAccess.vb`
- `SAIF.Application/ApplicationDataAccess.vb`
- `SAIF.Application/MessageFormatting.vb`
- `SAIF.Application/Service Based/ServiceResponse.vb`
- `SAIF.Application/Service Based/clsServiceAppManagerBase.vb`