--- title: SAIF.Business.View.Policy architecture summary: Architectural responsibilities, boundaries, and interaction patterns. status: draft owner: SAIF Corporation last_reviewed: 2026-08-21 library: SAIF.Business.View.Policy reference_type: embedded --- # SAIF.Business.View.Policy architecture SAIF.Business.View.Policy is a business/domain library in the SAIF BOF (Business Object Framework) stack that provides a read-only, policy-centric view of data for consumers such as the `LegalMaintenance` web application and `SAIF.Business.Claim.Legal`.* It aggregates policy header, period, address, agency, team, and association data behind the `clsPolicyData` root, and it is the only library in scope for this run that reaches two distinct databases: Oracle (primary) and SQL Server, referred to internally as "BDS" (secondary, security-only). ## Responsibilities - Provide a read-only projection of policy data: every `IBusinessCriteria` implementation in the library returns an empty string or throws for `CreateSQL`, `InsertSQL`, `UpdateSQL`, and `DeleteSQL`; only `RetrieveSQL` and dedicated retrieval-only SQL properties carry statements.* - Serve as the aggregate root and entry point for consumers via `clsPolicyData.GetPolicyData`, exposing lazily-populated child collections (`Agency`, `PolicyAddress`, `PolicyPeriods`, `TeamAssignmentCollection`, `TradingAsCollection`, `Associations`).* - Maintain the current policy-to-policy association model (`PolicyAssociations.vb`, `Associations/` folder) alongside the older, `` affiliate model (`clsAffiliatedPolicy*`, `AffiliateTypes`), both still reachable from `clsPolicyData`. - Enforce policy-level authorization (`clsPolicySecurity`), combining an Active Directory resource check (`SAIFpolicyInfo`) with a per-user-type data-access matrix and per-user-type policy-list stored procedures ([BR-VP-003](business-rules.md#br-vp-003-secure-policy-requires-ad-authorization), [BR-VP-005](business-rules.md#br-vp-005-access-granted-per-user-access-level-matrix)). - Apply demo-user data masking to names, addresses, and identifiers inside the business objects themselves rather than at the UI layer ([BR-VP-010](business-rules.md#br-vp-010-demo-users-see-masked-data)).* ## Component boundaries - `clsPolicyData` (aggregate root): central policy view; implements `iPayee`; owns lazy-read logic for detail, waiver, gaps, secondary status, coverage-bound flag, and information-page-printed flag. - `clsPolicyPeriod` / `clsPolicyPeriodCollection`: policy period (term) data and current/renewal period selection ([BR-VP-018](business-rules.md#br-vp-018-currentrenewal-period-selection)). - `clsPolicyAddress` (inherits `clsAddress`), `clsAgency`, `clsNonEmployerAccount`, `clsTradingAs` / `clsTradingAsCollection`, `clsTeamAssignment` / `clsTeamAssignmentCollection`: policy-adjacent entities retrieved as children of `clsPolicyData`. - `Associations/` (`clsAssociationTypeCode`, `clsAssociationTypeCodeCollection`, `clsPolicyHeaderAssociation`, `clsPolicyHeaderAssociationFactory`, `clsAssociationTypeFactory`) plus `PolicyAssociations.vb`: current policy-relationship model (categories `PR`/`MR`). - `clsAffiliatedPolicy` / `clsAffiliatedPolicyCollection`: legacy affiliate model, retained but ``. - `clsPolicySecurity` (with `IPolicySecurityDataProvider`, `strPolicyList`): the sole authorization boundary in the library; also owns the secondary SQL Server ("BDS") data layer, created via `clsSQLDataLayer` in `Initialize()`. - `Institutions` (generated typed DataSet): compiled but no consuming code was found within this library.** ## Interaction model - Consumers (`LegalMaintenance`, `SAIF.Application.Claim.Legal`, `SAIF.Business.Claim.Legal`) call `clsPolicyData.GetPolicyData` to obtain the aggregate root, then navigate to child properties, which are populated on first access rather than eagerly.* - `clsPolicyData` and its children execute Oracle retrieval statements through the BOF DPI (`IDataRequest`), using `:`-style bind parameters and `pk#####_` package procedures. - `clsPolicySecurity` independently executes SQL Server ("BDS") stored procedures (`cp_*`) through a data layer it creates itself, using `@`-style parameters; this is the only code path in the library that reaches the SQL Server database. - `clsPolicySecurity` also calls `SecurityPrincipal.IsAuthorized` (SAIF.Framework.Security) for the `SAIFpolicyInfo` Active Directory resource check. - Downstream Oracle package/procedure and SQL Server procedure bodies reside outside this repository and were not available for verification.** ## Architecture diagram The following diagram shows high-level component interactions across both database boundaries. ```mermaid flowchart TD Consumer[Consumer
LegalMaintenance / SAIF.Business.Claim.Legal] --> PolicyData[clsPolicyData
aggregate root] PolicyData --> Period["clsPolicyPeriod(Collection)"] PolicyData --> Address[clsPolicyAddress] PolicyData --> Agency[clsAgency] PolicyData --> Team["clsTeamAssignment(Collection)"] PolicyData --> TradingAs["clsTradingAs(Collection)"] PolicyData --> Associations["Associations /
PolicyAssociations"] PolicyData --> Affiliated["clsAffiliatedPolicy(Collection)
legacy, Obsolete"] PolicyData --> DPI[BOF DPI
IDataRequest] Security[clsPolicySecurity] --> AD[SecurityPrincipal.IsAuthorized
SAIFpolicyInfo] Security --> SQLLayer[clsSQLDataLayer] DPI --> Oracle[(Oracle
pk#####_ packages)] SQLLayer --> BDS[(SQL Server BDS
cp_* procedures)] ``` ## Sequence diagram The following diagram shows the primary policy-retrieve sequence, including the lazy detail read. ```mermaid sequenceDiagram participant Consumer participant PolicyData as clsPolicyData participant DPI as BOF DPI participant Oracle Consumer->>PolicyData: GetPolicyData(policyNum) PolicyData->>DPI: RetrieveSQL (pk73094_policy_data.getpolicy) DPI->>Oracle: execute with bind parameters Oracle-->>DPI: policy row DPI-->>PolicyData: populated fields PolicyData-->>Consumer: clsPolicyData instance Consumer->>PolicyData: PolicyDetail (first access) PolicyData->>DPI: RetrieveDetailSQL (pk72846_view_policy.getviewdetail) DPI->>Oracle: execute Oracle-->>DPI: detail row DPI-->>PolicyData: detail fields (lazy-populated) ``` ## Design constraints - Read-only by contract: create/insert/update/delete SQL properties are non-functional across all `Criteria` classes ([BR-VP-027](business-rules.md#br-vp-027-createinsertupdatedelete-sql-are-invalid)); mutation must occur through other libraries. - Two independent data stores must be reachable: Oracle for all domain retrieval, and SQL Server ("BDS") exclusively for `clsPolicySecurity` policy-list and group-membership queries. - `IPolicySecurityDataProvider` is declared but has no implementing type in this repository; any external implementation is unverified.** - Seven `.vb` files (MCO, payroll class, policy search, an older association type) exist on disk but are excluded from the `` item group and do not affect the shipped assembly.* - The library is not packaged or published from this repository; no NuGet pack/push step exists in its pipelines. > **Note:** Statements marked with * were inferred from code structure, naming conventions, or > contextual evidence where direct confirmation was not available in source artifacts. Statements > marked with ** could not be confirmed; treat as unknown until verified. ## Related documentation - [Index](index.md) - [Overview](overview.md) - [Dependencies](dependencies.md) - [Configuration](configuration.md) - [Operations and processes](operations-processes.md) - [Business rules](business-rules.md) - [Security and authorization](security-authorization.md) - [Database tables](database-tables.md) - [SQL catalog](sql/index.md) - [Procedures](procedures/index.md) - [API reference](api/index.md) ## Sources - `SAIF.Business.View.Policy/clsPolicyData.vb` - `SAIF.Business.View.Policy/clsPolicySecurity.vb` - `SAIF.Business.View.Policy/clsPolicyPeriod.vb` - `SAIF.Business.View.Policy/clsTeamAssignment.vb` - `SAIF.Business.View.Policy/clsTeamAssignmentCollection.vb` - `SAIF.Business.View.Policy/Associations/clsPolicyAssociation.vb` - `SAIF.Business.View.Policy/clsPolicySecurity.vb` - `SAIF.Business.View.Policy/clsPolicyData.vb` - `SAIF.Business.View.Policy/clsTeamAssignment.vb` - `SAIF.Business.View.Policy/clsTeamAssignmentCollection.vb` - `SAIF.Business.View.Policy/app.config` - `SAIF.Business.View.Policy/Web.config`