---
title: SAIF.Business.Tasks.Claim security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control.
status: draft
owner: SAIF Documentation
last_reviewed: 2026-08-21
library: SAIF.Business.Tasks.Claim
reference_type: embedded
---

# SAIF.Business.Tasks.Claim security and authorization

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure — identity arrives as `IDataPortalInfo.UserID`, per the SAIF infrastructure model; no authentication code exists in this library.

## Authorization architecture

Authorization in this library is entirely programmatic — no attributes and no local security-manager implementations. Task-owner assignment gates on AD resource membership via `ObjectServices`; "my tasks" retrieval gates confidentiality redaction on claim-level access rights via `ClaimServices`; and external return-to-work user assignment gates on a claim-assignment check via `clsClaimSecurity`.

```mermaid
flowchart TD
    Caller[clsClaimTask.MailID setter] --> ObjSvc[ObjectServices.HasResourceAccess /<br>HasResourceAccessExternal]
    ObjSvc --> AD[("Active Directory resource<br>groups")]
    Caller2[clsClaimTask.RTWAssignedClaim] --> ClaimSec[clsClaimSecurity.RTWAssignedToClaim]
    MyTasks[clsMyTaskCollection.AfterRetrieve] --> ClaimSvc[ClaimServices.Has*Access]
```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `CTTaskUpdate` | Grants a mailid the right to be assigned/update claim tasks | `clsClaimTask.ValidMailId` | SAIF.Business.Tasks.Claim/clsClaimTask.vb |
| `RTWExternalUpdate` | Grants an external return-to-work user limited task-update rights, subject to claim assignment | `clsClaimTask.ValidMailId` | SAIF.Business.Tasks.Claim/clsClaimTask.vb |

## Authorization enforcement points

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `clsClaimTask` | `ValidMailId` | `CTTaskUpdate` | `ObjectServices.HasResourceAccess` | SAIF.Business.Tasks.Claim/clsClaimTask.vb |
| `clsClaimTask` | `ValidMailId` | `RTWExternalUpdate` | `ObjectServices.HasResourceAccessExternal` | SAIF.Business.Tasks.Claim/clsClaimTask.vb |
| `clsMyTaskCollection` | `AfterRetrieve` | Exposure access | `ClaimServices.HasExposureAccess(True)` | SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb |
| `clsMyTaskCollection` | `AfterRetrieve` | Conflict access | `ClaimServices.HasConflictAccess(True)` | SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb |
| `clsMyTaskCollection` | `AfterRetrieve` | Collateral access | `ClaimServices.HasCollateralAccess(True)` | SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb |
| `clsMyTaskCollection` | `AfterRetrieve` | Secure access | `ClaimServices.HasSecureAccess(True)` | SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb |

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Claim (external RTW assignment) | `clsClaimTask.RTWAssignedClaim` | `clsClaimSecurity.RTWAssignedToClaim(dpi, ClaimID, MailID)` — external RTW user must be assigned to the claim ([BR-CT-06](business-rules.md#br-ct-06-external-rtw-user-must-be-assigned-to-the-claim)) | SAIF.Business.Tasks.Claim/clsClaimTask.vb |
| Claim (confidentiality masking) | `clsMyTaskCollection.AfterRetrieve` | Four-flag confidentiality check redacts `WorkerName` rather than denying access ([BR-MY-01](business-rules.md#br-my-01-confidential-worker-name-redaction)) | SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb |

## Segregation of duties

**None found.** No SOD rules were identified in this library.

## Security interfaces and contracts

**None defined in this library.** `ObjectServices` (SAIF.BOF.Framework) and `ClaimServices` / `clsClaimSecurity` (SAIF.BOF.Business.View.Claim) are consumed; the underlying AD/SecurityService resolution happens inside those packages, not here.**

## Notes
- AD resource names listed here use base names only. The framework appends `Resource` (production) or `TestResource` (non-production) at runtime.
- Assignee authorization is bypassed for informational messages, for self-assignment, and for `TEST`-prefixed accounts whose suffix matches the target mailid — the last is a test-environment accommodation compiled into production code ([BR-CT-03a](business-rules.md#br-ct-03a-assignee-validation-exemptions)).*

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [API reference](api/index.md)

## Sources
- SAIF.Business.Tasks.Claim/clsClaimTask.vb
- SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb