---
title: clsPolicySecurity
summary: API reference for clsPolicySecurity.
status: draft
owner: SAIF Corporation
last_reviewed: 2026-08-21
library: SAIF.Business.View.Policy
reference_type: embedded
---

# clsPolicySecurity

`clsPolicySecurity` is the library's sole authorization boundary for policy access. It evaluates a caller's `clsSecurityPrincipal` against both Oracle-backed policy facts and a secondary SQL Server BDS data layer created in `Initialize()`, combining AD resource checks, per-user-type access rules, parent-policy fallback, and user-specific policy-list retrieval so callers do not implement authorization logic themselves.

## Purpose
- Centralize policy-visibility decisions for employees, agents, policyholders, groups, auditors, and loss-control users instead of leaving each consumer to reconstruct the rules.
- Enforce secure-policy AD authorization, invalid-policy rejection, user-access-level mapping, auditor windows, loss-control identity matching, and parent-policy fallback ([BR-VP-003](../../business-rules.md#br-vp-003-secure-policy-requires-ad-authorization) through [BR-VP-009](../../business-rules.md#br-vp-009-fallback-to-parent-policy-authorization)).
- Retrieve the caller's accessible policy list from the appropriate backend routine based on user type, using SQL Server BDS procedures for most external-user lists and Oracle text SQL for the fee-auditor path.

## Context
- Namespace: `SAIF.Business.View.Policy`
- Assembly/package: `SAIF.Business.View.Policy` (embedded)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `New` | `Public Sub New(ByVal inSecurityPrincipal As clsSecurityPrincipal, ByVal inDPI As IDataPortalInfo)` | Captures the caller identity, stores the Oracle data portal, creates the BDS SQL Server data layer, and derives the normalized user type used by all later checks. |
| `IsPolicyValidForUser` | `Public Function IsPolicyValidForUser(ByRef inPolicyData As clsPolicyData) As Boolean` | Evaluates a fully loaded policy view against the user-type matrix, including secure-policy AD checks, direct ownership/group/auditor/loss-control rules, and policyholder parent fallback ([BR-VP-003](../../business-rules.md#br-vp-003-secure-policy-requires-ad-authorization) through [BR-VP-009](../../business-rules.md#br-vp-009-fallback-to-parent-policy-authorization)). |
| `IsPolicyValidForUser` | `Public Function IsPolicyValidForUser(ByVal inPolicyNum As Decimal) As Boolean` | Convenience overload that first retrieves `clsPolicyData` with the caller's access level, then runs the main authorization routine against that policy. |
| `IsPolicyValidForParentPolicy` | `Public Function IsPolicyValidForParentPolicy(ByVal inPolicyNum As Decimal) As Boolean` | Grants policyholder access through parent/child association membership when the requested policy is not the caller's exact policy number ([BR-VP-009](../../business-rules.md#br-vp-009-fallback-to-parent-policy-authorization)). |
| `CanAuditorAccessPolicy` | `Private Function CanAuditorAccessPolicy(ByVal inPolicyNumber As Decimal, ByVal inVendorNumber As String) As Boolean`* | Checks Oracle audit tables to determine whether an auditor still falls inside the 60-day cancellation/completion access window ([BR-VP-006](../../business-rules.md#br-vp-006-auditor-60-day-access-window)).* |
| `IsInGroup` | `Private Function IsInGroup(ByVal inPolicyNumber As Decimal, ByVal inGroup As String, ByVal inChapter As String) As Boolean`* | Uses SQL Server procedure `cp_policy_in_group` to decide whether a group user is authorized for the policy ([BR-VP-005](../../business-rules.md#br-vp-005-access-granted-per-user-access-level-matrix)).* |
| `PolicyList` | `Public ReadOnly Property PolicyList() As List(Of strPolicyList)` | Dispatches to the user-type-specific list builder—group, safety consultant, agent, fee auditor, or policyholder affiliate list—so callers can enumerate only the policies visible to the signed-in user ([BR-VP-005](../../business-rules.md#br-vp-005-access-granted-per-user-access-level-matrix)). |
| `ConvertUserTypeToUserAccessLevel` | `Public Shared Function ConvertUserTypeToUserAccessLevel(ByVal inUserType As clsUserType) As clsPolicyData.UserAccessLevels` | Normalizes application user types into the access-level enum that drives masking and authorization branches, including demo-user variants ([BR-VP-005](../../business-rules.md#br-vp-005-access-granted-per-user-access-level-matrix)). |
| `Initialize` | `Private Sub Initialize()`* | Reads `BDS_USER`, `bdsDatabase`, and `BDS_DATABASENAME` configuration values, then creates the secondary SQL Server `clsSQLDataLayer` used by group, agent, and safety-consultant list paths.* |
| `UserType` | `Public ReadOnly Property UserType() As clsUserType` | Exposes the normalized caller classification that selects authorization branches and policy-list routines. |
| `UserAccessLevel` | `Public ReadOnly Property UserAccessLevel() As clsPolicyData.UserAccessLevels` | Exposes the mapped access level used when retrieving `clsPolicyData` and interpreting demo-user masking behavior. |
| `SecurityPrincipal` | `Public ReadOnly Property SecurityPrincipal() As clsSecurityPrincipal` | Exposes the underlying authenticated principal whose AD-resource authorizations and user number drive security checks. |

## Behavioral notes
- `IsPolicyValidForUser(clsPolicyData)` first blocks invalid or zero policy numbers ([BR-VP-004](../../business-rules.md#br-vp-004-invalid-or-zero-policy-number-is-never-valid)).
- Secure policies require `SecurityPrincipal.IsAuthorized("SAIFpolicyInfo")`; otherwise access is denied immediately ([BR-VP-003](../../business-rules.md#br-vp-003-secure-policy-requires-ad-authorization)).
- The access matrix grants SAIF employees directly, checks agent ownership by agent number or agency sequence, calls `IsInGroup` for group users, uses team-assignment identity matching for loss control, and uses `CanAuditorAccessPolicy` for auditors ([BR-VP-005](../../business-rules.md#br-vp-005-access-granted-per-user-access-level-matrix), [BR-VP-006](../../business-rules.md#br-vp-006-auditor-60-day-access-window), [BR-VP-007](../../business-rules.md#br-vp-007-loss-control-prefix-match)).
- Demo loss-control users compare the policy team's hidden `UserIdName` instead of the masked display `UserName` when evaluating consultant access ([BR-VP-008](../../business-rules.md#br-vp-008-demo-loss-control-matched-on-useridname)).
- If direct policyholder access fails, `IsPolicyValidForParentPolicy` re-evaluates the request through parent-policy associations ([BR-VP-009](../../business-rules.md#br-vp-009-fallback-to-parent-policy-authorization)).
- The class uses two backends: Oracle for `clsPolicyData` retrieval and `CanAuditorAccessPolicy`, and SQL Server BDS for `IsInGroup`, group policy lists, safety-consultant books, and agent policy lists.
- `PolicyList` is lazy and user-type specific; it is not preloaded during construction.

## Constraints and usage notes
- This type should be treated as the only supported policy-authorization entry point in the library; other business objects expose data but do not authorize access themselves.
- Construction requires a valid Oracle `IDataPortalInfo` plus configuration for the secondary BDS connection.
- Policyholder list retrieval still depends on the obsolete affiliate collection rather than the newer associations API, so callers may see legacy semantics in that branch.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Business.View.Policy/clsPolicySecurity.vb`