SAIF.Application.Claim security and authorization¶

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a clsSecurityPrincipal on construction.

Authorization architecture¶

Authorization is centralized and delegated: AD resource-name membership resolution is entirely inherited (UserAccess.HasAccess / clsSecurityPrincipal.IsAuthorized) from SAIF.BOF.Framework.Security. SAIF.Application.Claim contributes only the claim-domain resource vocabulary (ClaimUserAccess) and the per-claim composition logic (ClaimSecurity), which ClaimAppManager.OnCheckSecurity converts into the coarse AppSecurityRole used by the rest of the solution.

flowchart TD
    Caller[Derived claim manager / UI] --> Manager[ClaimAppManager.OnCheckSecurity]
    Manager --> ClaimSec[ClaimSecurity.CheckClaim]
    ClaimSec --> UserAccess[ClaimUserAccess.HasAccess]
    UserAccess --> Principal[clsSecurityPrincipal.IsAuthorized]
    Manager --> Override[CheckForSecurityOverride]
    Override --> ClaimServices[ClaimServices.HasOverrideAcess]
    ClaimServices --> DB[(Claim database - ClaimDPI)]

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`SecureClaim`	Grants the user the right to view claims flagged as hostile-worker ("secure") claims	`ClaimSecurity.CheckClaim` (hostile-worker branch)	`SAIF.Application.Claim/ClaimUserAccess.vb`
`ConflictClaim`	Grants the user the right to view worker-conflict claims (SAIF employees/relatives)	`ClaimSecurity.CheckClaim`; enforced by `ClaimAppManager.OnCheckSecurity`	`SAIF.Application.Claim/ClaimUserAccess.vb`
`ExposureClaim`	Grants the user the right to view occupational-exposure claims	`ClaimSecurity.CheckClaim` (exposure and health-issue evaluation)	`SAIF.Application.Claim/ClaimUserAccess.vb`
`CollateralHealthClaim`	Intended to grant the right to view collateral health-issue claims	Exposed on the public surface via `ClaimUserAccess.HealthIssueAccess` but not consulted by `ClaimSecurity.CheckClaim`; no in-repository consumer found**	`SAIF.Application.Claim/ClaimUserAccess.vb`

Fully-qualified production group names are expected to be SAIF\<ResourceName>Resource, with ...TestResource variants in non-production; the environment suffix is appended downstream by clsSecurityPrincipal.IsAuthorized.*

Authorization enforcement points¶

Attribute-based authorization¶

None. This is a VB.NET class library with no controllers and no SAIFAuthorize/SaifAuthorize usage. Attribute-based authorization, if present in this solution, belongs to the hosting LegalMaintenance web application, not to this library.

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`ClaimUserAccess`	`SecureClaimAccess`	`SecureClaim`	`HasAccess`	`SAIF.Application.Claim/ClaimUserAccess.vb`
`ClaimUserAccess`	`ConflictAccess`	`ConflictClaim`	`HasAccess`	`SAIF.Application.Claim/ClaimUserAccess.vb`
`ClaimUserAccess`	`ExposureAccess`	`ExposureClaim`	`HasAccess`	`SAIF.Application.Claim/ClaimUserAccess.vb`
`ClaimUserAccess`	`HealthIssueAccess`	`CollateralHealthClaim`	`HasAccess` (no internal consumer — dead decision surface)	`SAIF.Application.Claim/ClaimUserAccess.vb`
`ClaimUserAccess`	`New(inSecurityPrincipal, ParamArray AccessRights())`	caller-supplied resource array	`CheckAccess` (bulk pre-resolution; not called anywhere in this library)	`SAIF.Application.Claim/ClaimUserAccess.vb`
`ClaimSecurity`	`CheckClaim`	Combines claim sensitivity flags with `ConflictClaim`/`ExposureClaim`/`SecureClaim`	Composite	`SAIF.Application.Claim/ClaimSecurity.vb`
`ClaimAppManager`	`OnCheckSecurity`	`ClaimSecurity.CheckClaim` + `CheckForSecurityOverride`	`MarkViewOnly`/`MarkNoAccess` gate (BR-CLM-006)	`SAIF.Application.Claim/ClaimAppManager.vb`
`ClaimAppManager`	`CheckForSecurityOverride`	Database override lookup	`ClaimServices.HasOverrideAcess(DPI, ClaimID, user)`	`SAIF.Application.Claim/ClaimAppManager.vb`
`ClaimAppManager`	`OnValidContext`	`SecurityRole = AppSecurityRole.NoAccess`	Secondary gate — blocks `Retrieve()`	`SAIF.Application.Claim/ClaimAppManager.vb`

9 programmatic enforcement points (7 active decision/gate points, excluding the unused HealthIssueAccess accessor and the unused bulk constructor). 0 attribute-based.

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Claim (`clsClaimData`)	`ClaimSecurity.CheckClaim(inClaim)`	Combines claim-record sensitivity flags (`IsWorkerConflict`, `IsExposure`, `IsHealthIssue`, `IsHostileWorker`) with the corresponding AD resource verdict; the same user's verdict differs claim-by-claim based on data stored on the claim row	`SAIF.Application.Claim/ClaimSecurity.vb`
Claim ↔ user override record	`ClaimAppManager.CheckForSecurityOverride()`	`ClaimServices.HasOverrideAcess(DPI, ClaimID, user)` — an out-of-band exception list keyed on the (claim, user) pair that supersedes the `ConflictClaim` AD denial; the backing SQL/table lives in `SAIF.BOF.Business.View.Claim` and was not resolvable here**	`SAIF.Application.Claim/ClaimAppManager.vb`

No ownership-style validation (IsValidPolicyForCurrentUser, ValidateOwnership) exists in this library — access is claim-sensitivity-driven, not claimant-ownership-driven.

Segregation of duties¶

None found. No *SegregationOfDuties*/*SOD* type and no mutually-exclusive-privilege rule appears in this library; the four resources are independent grants with no declared conflicts between them.

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`clsSecurityPrincipal`	Pre-authenticated identity carrier supplied by constructor injection at every entry point	`ClaimAppManager.New`, `ClaimSecurity.New`, `ClaimUserAccess.New`	`SAIF.Framework.Security` (`SAIF.BOF.Framework` package)†
`UserAccess` (base class)	Resource-membership cache and AD lookup contract	`ClaimUserAccess`	`SAIF.Application` (this repository)
`ClaimUserAccess`	Claim-domain AD resource vocabulary and membership accessor	`ClaimSecurity`	`SAIF.Application.Claim/ClaimUserAccess.vb`
`ClaimSecurity`	Per-claim composite access evaluator	`ClaimAppManager`, `SAIF.Application.Claim.Legal/LegalManagerBase.vb`, `SAIF.Application.Claim.Legal/LegalNet/clsCaseSearchManager.vb`	`SAIF.Application.Claim/ClaimSecurity.vb`

No ISecurityManager, SecurityServiceClient, PrincipalContext, GroupPrincipal, DirectorySearcher, or LDAP filter appears in this library; any WCF SecurityService hop occurs inside clsSecurityPrincipal.IsAuthorized, which is framework-internal and unknown from this repository.**

Notes¶

Fail-open by default. All four ClaimSecurity access flags initialize to True and are reset to True at the top of each CheckClaim branch; a claim whose sensitivity flags are all false is fully accessible to any authenticated user.
Only the conflict dimension blocks access automatically (BR-CLM-012); exposure, hostile-worker, and health-issue restrictions are advisory and must be enforced by each consuming manager — SAIF.Application.Claim.Legal/LegalManagerBase.vb and SAIF.Application.Claim.Legal/LegalNet/clsCaseSearchManager.vb do so for the exposure dimension.*
ClaimSecurity and ClaimUserAccess are both <Serializable()>; a persisted instance could carry stale AD verdicts across a group-membership change.*
ClaimSecurity.m_HasAccessToClaim is declared and initialized but never read or written — dead security state.**
AD resource names listed here use base names only. The framework appends Resource (production) or TestResource (non-production) at runtime.
Whether ClaimServices.HasOverrideAcess queries a claim-override table, an AD group, or a cached list could not be determined from this repository.**

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified. Statements marked with † were retrieved from dependency library documentation via the Legends CLI RAG service. They describe inherited behavior from the indicated origin library and should be verified if the dependency version changes.

Sources¶

SAIF.Application.Claim/ClaimUserAccess.vb
SAIF.Application.Claim/ClaimSecurity.vb
SAIF.Application.Claim/ClaimAppManager.vb
SAIF.Application.Claim/ClaimAppConstants.vb
SAIF.Application.Claim.Legal/LegalManagerBase.vb
SAIF.Application.Claim.Legal/LegalNet/clsCaseSearchManager.vb