SAIF.Application.Claim security and authorization¶

This page documents authorization mechanisms implemented or consumed by SAIF.Application.Claim. Authentication is out of scope — this library receives an already-authenticated clsSecurityPrincipal/WindowsIdentity and performs authorization only.

Authorization architecture¶

Authorization is entirely programmatic and layered on an inherited AD-resource-token pattern (UserAccess.HasAccess). No direct WCF SecurityService client code is present in this library — any WCF call underlying HasAccess is encapsulated inside the external SAIF.Application project reference and is not observable from this library's source*. ClaimUserAccess (per-user AD-resource access token) is combined by ClaimSecurity (per-claim access decision) with each clsClaimData instance's characteristic flags; ClaimAppManager.OnCheckSecurity() is the single enforcement point that consumes the result.

flowchart TD
    Caller["Concrete claim-screen<br>AppManager subclass"] --> CAM["ClaimAppManager.OnCheckSecurity()"]
    CAM --> SEC["ClaimSecurity.CheckClaim()"]
    SEC --> UA["ClaimUserAccess"]
    UA --> BaseUA["UserAccess.HasAccess()<br>(SAIF.Application, local ref)"]
    BaseUA --> AD[("Active Directory<br>(encapsulated, not observable)")]
    CAM --> Override["CheckForSecurityOverride()"]
    Override --> CS["ClaimServices.HasOverrideAcess()<br>(unresolved external dependency)"]

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`SecureClaim`	Grants access to claims flagged as involving a hostile worker (`IsHostileWorker`). Constant key `SECURECLAIMSECURITYKEY`.	`ClaimUserAccess.SecureClaimAccess` → `HasAccess("SecureClaim")`; consumed by `ClaimSecurity.CheckClaim` to set `m_SecureClaimAccess`, enforcing BR-CLM-004.	`SAIF.Application.Claim\ClaimUserAccess.vb`
`ConflictClaim`	Grants access to claims flagged as a worker conflict (`IsWorkerConflict`). Constant key `CONFLICTSECURITYKEY`.	`ClaimUserAccess.ConflictAccess` → `HasAccess("ConflictClaim")`; consumed by `ClaimSecurity.CheckClaim` to set `m_ConflictAccess`, which directly gates `ClaimAppManager.OnCheckSecurity()`'s hard `MarkNoAccess()` denial (BR-CLM-001).	`SAIF.Application.Claim\ClaimUserAccess.vb`; `SAIF.Application.Claim\ClaimAppManager.vb`
`ExposureClaim`	Grants access to claims flagged as an exposure claim (`IsExposure`), and indirectly to health-issue claims that are also exposure claims. Constant key `EXPOSURESECURITYKEY`.	`ClaimUserAccess.ExposureAccess` → `HasAccess("ExposureClaim")`; consumed by `ClaimSecurity.CheckClaim` to set both `m_ExposureAccess` (BR-CLM-002) and (conditionally) `m_HealthIssueAccess` (BR-CLM-003).	`SAIF.Application.Claim\ClaimUserAccess.vb`
`CollateralHealthClaim`	Named/intended to grant access to health-issue claims. Constant key `HEALTHISSUESECURITYKEY`.	`ClaimUserAccess.HealthIssueAccess` → `HasAccess("CollateralHealthClaim")`. Declared but never consulted: `ClaimSecurity.CheckClaim` gates health-issue access using `UserAccess.ExposureAccess`, not `UserAccess.HealthIssueAccess`, so this resource key currently has no effect on the computed BR-CLM-003 flag*.	`SAIF.Application.Claim\ClaimUserAccess.vb`; `SAIF.Application.Claim\ClaimSecurity.vb`

All four resource names are base names per the SAIF <ResourceName>Resource/<ResourceName>TestResource convention; the environment suffix is applied inside the inherited UserAccess.HasAccess/IsAuthorized implementation (in SAIF.Application, outside this library's scope), not in this library's code*.

Authorization enforcement points¶

No attribute-based authorization exists in this library (no MVC controllers/actions, no [SAIFAuthorize]/[SaifAuthorize] decorations — this is a Component-tier application-manager library, not a presentation-layer project). All enforcement is programmatic.

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`ClaimAppManager`	`OnCheckSecurity()`	`ConflictClaim` (direct hard gate); `ExposureClaim`, `SecureClaim`, `CollateralHealthClaim` (flags computed but not directly gated here)	Programmatic lifecycle override; primary enforcement point. Runs on every successful context change, enforcing BR-CLM-001 through BR-CLM-005.	`SAIF.Application.Claim\ClaimAppManager.vb`
`ClaimAppManager`	`CheckForSecurityOverride()`	N/A — delegates entirely to an external call	`Return ClaimServices.HasOverrideAcess(DPI, ClaimData.ClaimID, SecurityPrincipal.UserName.ToString)`. This is the only path by which a `ConflictClaim`-access denial can be bypassed for BR-CLM-001. `ClaimServices` is not defined anywhere in this library or elsewhere in the scanned repository**.	`SAIF.Application.Claim\ClaimAppManager.vb`
`ClaimSecurity`	`CheckClaim(inClaim As clsClaimData)`	All four resources	Rule-evaluation logic (not itself an enforcement point); recomputes all four access flags from the current `ClaimUserAccess` token and the passed-in claim's characteristic flags.	`SAIF.Application.Claim\ClaimSecurity.vb`
`ClaimAppManager`	`OnCreateDataLayer()`	N/A (fail-safe, not resource-based)	On a caught exception while establishing the Oracle data portal, calls `MarkContextNotSet()` and `MarkNoAccess()` before re-throwing — a connectivity-failure fail-closed behavior rather than an AD-resource check.	`SAIF.Application.Claim\ClaimAppManager.vb`

Data-level authorization¶

ClaimSecurity.CheckClaim(inClaim As clsClaimData) is a composite, per-claim data-level authorization check combining a claim characteristic with an AD-resource membership flag:

Entity type	Validation method	Mechanism	Source
Claim (conflict)	`ClaimSecurity.CheckClaim`	`inClaim.IsWorkerConflict` + `UserAccess.ConflictAccess` (BR-CLM-001)	`SAIF.Application.Claim\ClaimSecurity.vb`
Claim (exposure)	`ClaimSecurity.CheckClaim`	`inClaim.IsExposure` + `UserAccess.ExposureAccess` (BR-CLM-002)	`SAIF.Application.Claim\ClaimSecurity.vb`
Claim (health issue)	`ClaimSecurity.CheckClaim`	`inClaim.IsHealthIssue AndAlso inClaim.IsExposure` + `UserAccess.ExposureAccess` — not `UserAccess.HealthIssueAccess`* (BR-CLM-003)	`SAIF.Application.Claim\ClaimSecurity.vb`
Claim (hostile/secure)	`ClaimSecurity.CheckClaim`	`inClaim.IsHostileWorker` + `UserAccess.SecureClaimAccess` (BR-CLM-004)	`SAIF.Application.Claim\ClaimSecurity.vb`

Of the four computed flags, only ConflictAccess is directly consumed by this library's own enforcement code (OnCheckSecurity()'s hard MarkNoAccess() gate); ExposureAccess, HealthIssueAccess, and SecureClaimAccess are exposed as public read-only properties for external callers (e.g., screen-level field/section visibility logic outside this library) to consult and enforce themselves* — this library does not itself hide or block access to exposure/health-issue/hostile-worker data beyond exposing these flags.

No entity-ownership validation methods (e.g., IsValidPolicyForCurrentUser) were found in this library; ClaimAppManager.OnValidContext() checks ContextSet, SecurityRole <> NoAccess, and ClaimData.IsValid, which is a context-validity check rather than an ownership check.

Segregation of duties¶

None found. No segregation-of-duties classes, methods, or SQL privilege-combination checks exist in this library's source.

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`UserAccess`	Base type supplying `HasAccess` AD-resource lookup (local project reference, `SAIF.Application`, not re-documented here)	`ClaimUserAccess`	`SAIF.Application.Claim\ClaimUserAccess.vb`
`clsSecurityPrincipal`	Authenticated principal type (external, `SAIF.Business`/framework package)	`ClaimSecurity` constructors	`SAIF.Application.Claim\ClaimSecurity.vb`

No ISecurityManager/IClaimSecurityManager/DomainSecurityManagerBase implementations exist directly in this library — UserAccess.HasAccess (the actual AD lookup) is implemented in SAIF.Application, outside this library's scope*.

Notes¶

Machine/application authorization: not present — no machine-account ($-suffixed SAMAccountName) validation or MachineSecurityService usage exists in this library's source.
Coverage assessment: of the four resource keys defined, only two (SecureClaim's underlying hostile-worker check and ConflictClaim) are fully wired end-to-end from resource lookup to an access-affecting outcome; ExposureClaim gates its own flag correctly but the flag is not itself consulted by OnCheckSecurity(); CollateralHealthClaim is defined and exposed but not consulted at all by ClaimSecurity.CheckClaim, making it effectively dead from this library's perspective.
Mark inferred statements with * and unknown statements with **. Do not use bold inline confidence labels.
AD resource names listed here use base names only. The framework appends Resource (production) or TestResource (non-production) at runtime.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

SAIF.Application.Claim\ClaimAppManager.vb
SAIF.Application.Claim\ClaimSecurity.vb
SAIF.Application.Claim\ClaimUserAccess.vb
SAIF.Application.Claim\ClaimAppConstants.vb
SAIF.Application.Claim\ClaimContext.vb
SAIF.Application.Claim\SAIF.Application.Claim.vbproj