---
title: Evaluate and cache AD resource access
summary: Answer whether the current user holds a named AD resource, reusing prior answers.
status: draft
owner: SAIF Documentation
last_reviewed: 2026-08-26
library: SAIF.Application
reference_type: embedded
operation_id: evaluate-and-cache-ad-resource-access
trigger: A derived access class (e.g. ClaimUserAccess) is asked whether the current user holds a named AD resource
---

# Evaluate and cache AD resource access

Answers whether the current user holds a named Active Directory resource, checking a per-instance
cache before delegating to the security principal.

| Field | Value |
| --- | --- |
| **Operation ID** | evaluate-and-cache-ad-resource-access |
| **Trigger** | A derived access class (e.g. `ClaimUserAccess`) is asked whether the current user holds a named AD resource |
| **Inputs** | One or more AD resource names; a `clsSecurityPrincipal` previously supplied via `SetPrincipal` |
| **Outputs** | `Boolean` authorization result; a populated per-instance cache |
| **Primary components** | `UserAccess.CheckAccess`, `UserAccess.HasAccess`, `UserAccess.SetPrincipal` |
| **Entry point** | `SAIF.Application/UserAccess.vb` |

## Steps

1. A derived access class calls `SetPrincipal(inPrincipal)` to bind the identity; if this is skipped,
   `HasAccess` fails with a null-reference on the first uncached lookup.**
2. `HasAccess(inResourceName)` lower-cases the resource name and probes `m_AccessControl`; a cache hit
   returns the stored `Boolean` immediately
   ([BR-APP-004](../business-rules.md#br-app-004-ad-resource-authorization-is-cached-per-instance)).
3. A cache miss calls `m_Principal.IsAuthorized(inResourceName)` (the framework appends the environment
   suffix to the resource name), caches the result, and returns it.
4. `CheckAccess(ParamArray inResourceName())` loops the supplied names calling `HasAccess` on each
   purely to warm the cache; the loop variable is overwritten each iteration and then discarded, so the
   method returns no information to the caller.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start(["HasAccess<br>called"]) --> Bind["SetPrincipal bound<br>identity"]
	Bind --> Cache{"Cached?"}
	Cache -->|Yes| Return["Return cached<br>Boolean"]
	Cache -->|No| Query["m_Principal.IsAuthorized"]
	Query --> StoreCache["Cache result"]
	StoreCache --> Return
```

## Failure and edge-case behavior
- If `SetPrincipal` was never called, the first uncached lookup fails with a null-reference exception.**
- `CheckAccess` warms the cache for multiple resource names but discards its own loop result, so it
  cannot be used to test a specific name's outcome.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)