SAIF.Application.Claim.Legal security and authorization

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a WindowsIdentity on the request context.

Authorization architecture

Authorization in this library is exclusively programmatic: every enforcement point is a Boolean property or inline conditional wrapping a call to SecurityPrincipal.IsAuthorized(<key>), where SecurityPrincipal is the clsSecurityPrincipal instance (SAIF.BOF.Framework.Security) injected into every manager's constructor and exposed through the inherited ClaimAppManager base. There is no [SAIFAuthorize]/[SaifAuthorize] attribute-based gating in this library (this is an Application-tier BOF manager library, not an MVC controller library), and no direct WCF SecurityService proxy usage or AD/LDAP API calls are present — the concrete AD-group-membership resolution mechanism behind IsAuthorized is opaque to this library, implemented inside the external clsSecurityPrincipal type*.

flowchart TD
    UI["*Manager constructor<br>(inSecurityPrincipal)"] --> LMB["LegalManagerBase.OnRetrieve<br>(claim-level view gate)"]
    LMB --> Principal["clsSecurityPrincipal.IsAuthorized(key)"]
    CNM["clsCaseNotesManager<br>(note-level gate)"] --> Principal
    SCH["clsScheduleManager<br>(LCE flags)"] --> Principal
    Principal --> External["AD group resolution<br>(opaque — SAIF.BOF.Framework.Security)"]

AD resource catalog

Resource name	Purpose	Enforcement point	Source
LNConflict	Grants access to view claims flagged as worker-conflict cases.	LegalManagerBase.HasLegalConflictAccess	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LNExposure	Grants access to view claims flagged as exposure/confidential.	LegalManagerBase.HasLegalExposureAccess	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LNAdmin	Full Legal-admin bypass: unconditional claim-view access plus full note edit/delete rights.	LegalManagerBase.IsInAdminGroup; consumed by LegalManagerBase.OnRetrieve and clsCaseNotesManager.CanUpdateAnyNote	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LNCaseUpdate	Case-update role: broad note edit/delete rights and a general case-update flag exposed to callers*.	LegalManagerBase.IsInCaseUpdateGroup; consumed by clsCaseNotesManager.CanUpdateAnyNote	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LNView	View-only role flag; no additional branching logic found in this library beyond exposing the flag — likely consumed by the Legal\ web front end to restrict UI controls**.	LegalManagerBase.IsInViewOnly	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LNNoteView	Grants case-note viewing capability.	clsCaseNotesManager.IsInNoteView	SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
LNUpdate	Grants bill-note (DOCCO category) update capability to non-admin/non-case-update users.	clsCaseNotesManager.CanUpdateBillNotes	SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
LNLCEUpdate	LCE (Legal Case Evaluation) update role; exposed but no further branching logic observed in this library beyond the getter**.	clsScheduleManager.IsInLCEUpdateGroup	SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb
LNDueDateUpdate	LCE due-date update role; same caveat as LNLCEUpdate**.	clsScheduleManager.IsInLCEDueDateGroup	SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb

All 9 keys use the SAIF base-resource-name convention (no Resource/TestResource suffix visible in code — the suffix is appended internally by clsSecurityPrincipal.IsAuthorized)*.

Authorization enforcement points

No attribute-based ([SAIFAuthorize]/[SaifAuthorize]) enforcement points exist in this library; all 11 enforcement points below are programmatic.

Programmatic authorization checks

Class	Method / Property	Resource / Role	Check type	Source
LegalManagerBase	OnRetrieve (composite: LNAdmin bypass, else HasLegalConflictAccess/LNConflict + CheckForSecurityOverride, else HasLegalExposureAccess/LNExposure + CheckForSecurityOverride)	LNAdmin, LNConflict, LNExposure	IsAuthorized (composite orchestration)	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LegalManagerBase	IsInAdminGroup	LNAdmin	IsAuthorized	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LegalManagerBase	IsInCaseUpdateGroup	LNCaseUpdate	IsAuthorized	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LegalManagerBase	IsInViewOnly	LNView	IsAuthorized	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LegalManagerBase	HasLegalConflictAccess	LNConflict	IsAuthorized	SAIF.Application.Claim.Legal\LegalManagerBase.vb
LegalManagerBase	HasLegalExposureAccess	LNExposure	IsAuthorized	SAIF.Application.Claim.Legal\LegalManagerBase.vb
clsCaseNotesManager	CanUpdateAnyNote (composite: LNAdmin OR LNCaseUpdate)	LNAdmin, LNCaseUpdate	IsAuthorized (composite property)	SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
clsCaseNotesManager	CanUpdateBillNotes	LNUpdate	IsAuthorized	SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
clsCaseNotesManager	IsInNoteView	LNNoteView	IsAuthorized	SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
clsScheduleManager	IsInLCEUpdateGroup	LNLCEUpdate	IsAuthorized	SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb
clsScheduleManager	IsInLCEDueDateGroup	LNDueDateUpdate	IsAuthorized	SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb

All 22 concrete manager classes inherit the LegalManagerBase.OnRetrieve claim-level view gate. Only clsCaseNotesManager and clsScheduleManager add class-specific checks beyond this inherited gate; the remaining 19 concrete managers (Appeal, Assignment, Attorney/Hearing-Location/Person maintenance, Board Log, Case Cost, Case Search, Create File, Mail Date, Other Parties, Outcome, Quick Cal, Request, Summary, Update Case, Acknowledge, Attorney Messages) perform no additional security-key checks*.

Data-level authorization

Entity type	Validation method	Mechanism	Source
Case note	clsCaseNotesManager.DeleteNote	Composite check: deletion blocked unless CanUpdateAnyNote (LNAdmin OR LNCaseUpdate) or the note's CategoryCode = "DOCCO" (bill note); unconditionally blocked when note.CreateUser = "SYSTEM", regardless of role.	SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
Case note (read)	clsCaseNotesManager.GetNotes	Per-note CanUpdate/CanUpdateText flags computed from CanUpdateAnyNote/CanUpdateBillNotes at retrieval time — a request-scoped, cached authorization result attached to each note for the presentation layer.	SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
Legal claim/case	LegalManagerBase.OnRetrieve	Composite check combining ClaimData.IsWorkerConflict/ClaimData.IsExposure entity attributes with HasLegalConflictAccess/HasLegalExposureAccess AD-resource checks and an external CheckForSecurityOverride() escape hatch (defined in SAIF.Application.Claim, not this library)*.	SAIF.Application.Claim.Legal\LegalManagerBase.vb

Security interfaces and contracts

Interface / Class	Role	Consumers	Source
clsSecurityPrincipal (SAIF.BOF.Framework.Security, external binary reference)	Injected security principal exposing IsAuthorized(<key>) (the sole authorization-check abstraction used by this library) and GetDefaultPrinter() (non-authorization, principal-derived configuration).	Every one of the 22 concrete *Manager classes and LegalManagerBase, via constructor injection (inSecurityPrincipal As clsSecurityPrincipal).	SAIF.Application.Claim.Legal\LegalManagerBase.vb

Notes

• No segregation-of-duties (SOD) rules were found — no classes/methods matching SOD naming conventions, no conflicting-privilege checks, and no machine/application ($-suffix) authorization patterns exist in this library.
• Mark inferred statements with * and unknown statements with **. Do not use bold inline confidence labels.
• AD resource names listed here use base names only. The framework appends Resource (production) or TestResource (non-production) at runtime.

Related documentation

• Index
• Overview
• Architecture
• Dependencies
• Operations and processes
• Business rules
• Database tables
• SQL catalog
• Configuration
• API reference

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• SAIF.Application.Claim.Legal\LegalManagerBase.vb
• SAIF.Application.Claim.Legal\LegalNet\clsCaseNotesManager.vb
• SAIF.Application.Claim.Legal\LegalNet\clsScheduleManager.vb
• SAIF.Application.Claim.Legal\LegalNet\clsAppealManager.vb
• SAIF.Application.Claim.Legal\LegalNet\clsCreateFileManager.vb
• SAIF.Application.Claim.Legal\LegalNet\clsMailDateManager.vb
• SAIF.Application.Claim.Legal\LegalNet\clsRequestManager.vb
• SAIF.Application.Claim.Legal\clsAttorneyTableManager.vb
• SAIF.Application.Claim.Legal\clsHearingLocationManager.vb
• SAIF.Application.Claim.Legal\clsLegalPersonManager.vb
• SAIF.Application.Claim.Legal\clsMaintenanceManager.vb