SAIF.Business.View.Policy security and authorization¶

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a WindowsIdentity/clsSecurityPrincipal on the request context. clsPolicySecurity is a dedicated, programmatic (non-attribute-based) authorization class: it derives a clsUserType from the supplied principal and implements a composite check — a global secure-policy/AD-resource gate followed by a per-user-type ownership/scope rule (Determine whether the current user may view a policy).

Authorization architecture¶

Local, programmatic, data-scoped authorization performed by a domain-tier class (clsPolicySecurity), combined with a single AD-resource check delegated to the externally-defined clsSecurityPrincipal.IsAuthorized method. No direct System.DirectoryServices usage and no direct WCF SecurityService proxy calls are present in this library — the AD lookup is fully encapsulated behind clsSecurityPrincipal, whose implementation is external to this repository.**

flowchart TD
    Caller[Calling code] --> Construct[Construct clsPolicySecurity from clsSecurityPrincipal + DPI]
    Construct --> Gate{SecurePolicyCode = SAIF and not authorized for SAIFpolicyInfo?}
    Gate -->|Yes| Deny([Access denied])
    Gate -->|No| Validity{Policy valid and non-zero?}
    Validity -->|No| Deny
    Validity -->|Yes| UserType[Select Case UserType.UserType]
    UserType --> Result([hasAccess returned to caller])

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`SAIFpolicyInfo`	Gates access to "secure" SAIF-owned policies (`SecurePolicyCode = clsConstants.SAIF`). Any user, regardless of user type, is denied access to a secure policy unless this AD resource membership check succeeds. This is a data-level, policy-scoped override that runs before the per-user-type switch.	`clsPolicySecurity.IsPolicyValidForUser(inPolicyData As clsPolicyData)`, via `SecurityPrincipal.IsAuthorized("SAIFpolicyInfo")`	`SAIF.Business.View.Policy\clsPolicySecurity.vb`

Only one AD resource name is referenced in this library's source. The environment suffix (Resource/TestResource) and the underlying AD lookup/domain routing are applied inside clsSecurityPrincipal.IsAuthorized, implemented in the external SAIF.BOF.Framework.Security assembly and not available as source in this repository.*

Authorization enforcement points¶

No [SAIFAuthorize]/[SaifAuthorize] MVC attributes or other attribute-based enforcement points were found in this library — it is a business/domain-tier VB.NET class library, not an MVC front end, so attribute-based authorization is not expected here.*

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`clsPolicySecurity`	`IsPolicyValidForUser`	`SAIFpolicyInfo` (secure-policy gate)	`IsAuthorized`	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsPolicyValidForUser`	Policy validity gate (`IsValid`/`PolicyNum <> 0`)	Data validity check	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsPolicyValidForUser` (Agent case)	Agent/agency number match	Ownership check	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsPolicyValidForParentPolicy`	Policyholder/parent-affiliate ownership	Ownership + affiliation-association check	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsInGroup`	Group membership	Stored-procedure check (SQL-VP-033)	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`CanSafetyConsultantAccessPolicy`	Loss-control team-assignment match	Username-prefix match	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`CanAuditorAccessPolicy`	Fee-auditor vendor/audit-record match	SQL query (SQL-VP-037)	`SAIF.Business.View.Policy\clsPolicySecurity.vb`

Eight distinct programmatic enforcement points in total (the secure-policy gate + validity gate + six per-user-type/ownership checks including the internal-user-types unconditional grant). Any user type not matched by the Select Case falls through to an implicit deny (hasAccess remains False).*

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Policy (secure-policy override)	`clsPolicySecurity.IsPolicyValidForUser`	Composite: `SecurePolicyCode = clsConstants.SAIF` AND not authorized for `SAIFpolicyInfo` → deny	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
Policy (agent)	`clsPolicySecurity.IsPolicyValidForUser` (Agent case)	String match of `UserType.UserNumber` against `inPolicyData.AgentNum` or `inPolicyData.Agency.AgencySeqNum`	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
Policy (policyholder/parent affiliate)	`clsPolicySecurity.IsPolicyValidForParentPolicy`	Self-match on policy number, else lookup of parent association types on the user's own policy data and a match against the requested policy's associations	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
Policy (group)	`clsPolicySecurity.IsInGroup`	Stored procedure `cp_policy_in_group`, parameterized by `GroupID`/`GroupChapterID` (SQL-VP-033)	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
Policy (loss-control consultant)	`clsPolicySecurity.CanSafetyConsultantAccessPolicy`	Team-assignment lookup plus case-insensitive username-prefix match; uses `UserIdName` instead of `UserName` for demo loss-control users	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
Policy (fee auditor/vendor)	`clsPolicySecurity.CanAuditorAccessPolicy`	Direct SQL join across `PA_AUDIT`, `PA_AUDITOR`, `PA_POLICY_PERIOD` filtering on vendor number and policy number, excluding cancelled/completed audits older than a threshold date (SQL-VP-037)	`SAIF.Business.View.Policy\clsPolicySecurity.vb`

Demo-user data masking (privacy control)¶

clsPolicyData exposes IsDemoUser (true for any Demo* UserAccessLevel). When true, the following properties substitute masked/constant values instead of returning real policyholder data. This does not gate access — access is governed entirely by IsPolicyValidForUser — it only ensures that once access is granted to a recognized demo-tier user, real PII is not disclosed.*

Property	Masked value when `IsDemoUser`	Real value otherwise
Legal name	`clsConstants.DataMaskingConstants.POLICYHOLDER_LEGAL_NAME`	`m_LegalName`
Policy name	`clsConstants.DataMaskingConstants.POLICYHOLDER_NAME`	`m_PolicyName`
Group name	`clsConstants.DataMaskingConstants.GROUP_NAME`	`m_GroupName`
FEID number	`clsConstants.DataMaskingConstants.POLICYHOLDER_FEID`	`m_FeidNum`
NCCI risk ID	`clsConstants.DataMaskingConstants.NCCI_RISK_ID`	`m_NcciRiskID`
NCCI binder number	Literal `"999999999999999999"`	`m_NcciBinderNum`
WCD number	Literal `9999999`	`m_WcdNum`
Web address	Literal `"Web Address"`	`m_WebAddr`

Related demo-user masking also applies to clsAgency (BR-VP-010), clsPolicyAddress (BR-VP-011), and clsTeamAssignment (BR-VP-012).

Segregation of duties¶

No segregation-of-duties classes, methods, or privilege-combination queries were found in this library. No *SegregationOfDuties*/*SOD* naming or queries against employee_access/ menu_structure-style tables were found.

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`clsSecurityPrincipal`	Authenticated-identity/principal type exposing `IsAuthorized(ResourceName)`; not defined in this library — consumed from the external `SAIF.BOF.Framework.Security` assembly.**	`clsPolicySecurity` (constructor parameter)	`SAIF.Business.View.Policy\clsPolicySecurity.vb`
`clsUserType`	Classifies the authenticated principal into `UserTypes.{SaifEmployee, Agent, PolicyHolder, Group, LossControl, Auditor, MCO, MedProv, Bookkeeper}`; not defined in this library.**	`clsPolicySecurity`	`SAIF.Business.View.Policy\clsPolicySecurity.vb`

Inherited security¶

No inherited authentication/authorization mechanism was returned from the dependency documentation lookup for this library's frameworkDensity base classes (clsBusinessBase, clsBusinessCollection, clsBusinessCollectionBase, clsAddress — all from saif.framework.core) — only generic BOF lifecycle mechanisms with no security-specific content were found, so this section is omitted.

Notes¶

Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.
Statements marked with ** could not be confirmed; treat as unknown until verified.
AD resource names listed here use base names only. The framework appends Resource (production) or TestResource (non-production) at runtime.
No WCF SecurityService proxy calls, System.DirectoryServices usage, or machine/service-account authorization logic were found anywhere in this library.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

SAIF.Business.View.Policy\clsPolicySecurity.vb
SAIF.Business.View.Policy\clsPolicyData.vb
SAIF.Business.View.Policy\SAIF.Business.View.Policy.vbproj