SAIF.Business.Tasks.Claim security and authorization¶

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure — identity arrives as IDataPortalInfo.UserID, per the SAIF infrastructure model; no authentication code exists in this library.

Authorization architecture¶

Authorization in this library is entirely programmatic — no attributes and no local security-manager implementations. Task-owner assignment gates on AD resource membership via ObjectServices; "my tasks" retrieval gates confidentiality redaction on claim-level access rights via ClaimServices; and external return-to-work user assignment gates on a claim-assignment check via clsClaimSecurity.

flowchart TD
    Caller[clsClaimTask.MailID setter] --> ObjSvc[ObjectServices.HasResourceAccess /<br>HasResourceAccessExternal]
    ObjSvc --> AD[("Active Directory resource<br>groups")]
    Caller2[clsClaimTask.RTWAssignedClaim] --> ClaimSec[clsClaimSecurity.RTWAssignedToClaim]
    MyTasks[clsMyTaskCollection.AfterRetrieve] --> ClaimSvc[ClaimServices.Has*Access]

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`CTTaskUpdate`	Grants a mailid the right to be assigned/update claim tasks	`clsClaimTask.ValidMailId`	SAIF.Business.Tasks.Claim/clsClaimTask.vb
`RTWExternalUpdate`	Grants an external return-to-work user limited task-update rights, subject to claim assignment	`clsClaimTask.ValidMailId`	SAIF.Business.Tasks.Claim/clsClaimTask.vb

Authorization enforcement points¶

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`clsClaimTask`	`ValidMailId`	`CTTaskUpdate`	`ObjectServices.HasResourceAccess`	SAIF.Business.Tasks.Claim/clsClaimTask.vb
`clsClaimTask`	`ValidMailId`	`RTWExternalUpdate`	`ObjectServices.HasResourceAccessExternal`	SAIF.Business.Tasks.Claim/clsClaimTask.vb
`clsMyTaskCollection`	`AfterRetrieve`	Exposure access	`ClaimServices.HasExposureAccess(True)`	SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb
`clsMyTaskCollection`	`AfterRetrieve`	Conflict access	`ClaimServices.HasConflictAccess(True)`	SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb
`clsMyTaskCollection`	`AfterRetrieve`	Collateral access	`ClaimServices.HasCollateralAccess(True)`	SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb
`clsMyTaskCollection`	`AfterRetrieve`	Secure access	`ClaimServices.HasSecureAccess(True)`	SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Claim (external RTW assignment)	`clsClaimTask.RTWAssignedClaim`	`clsClaimSecurity.RTWAssignedToClaim(dpi, ClaimID, MailID)` — external RTW user must be assigned to the claim (BR-CT-06)	SAIF.Business.Tasks.Claim/clsClaimTask.vb
Claim (confidentiality masking)	`clsMyTaskCollection.AfterRetrieve`	Four-flag confidentiality check redacts `WorkerName` rather than denying access (BR-MY-01)	SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb

Segregation of duties¶

None found. No SOD rules were identified in this library.

Security interfaces and contracts¶

None defined in this library. ObjectServices (SAIF.BOF.Framework) and ClaimServices / clsClaimSecurity (SAIF.BOF.Business.View.Claim) are consumed; the underlying AD/SecurityService resolution happens inside those packages, not here.**

Notes¶

AD resource names listed here use base names only. The framework appends Resource (production) or TestResource (non-production) at runtime.
Assignee authorization is bypassed for informational messages, for self-assignment, and for TEST-prefixed accounts whose suffix matches the target mailid — the last is a test-environment accommodation compiled into production code (BR-CT-03a).*

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

SAIF.Business.Tasks.Claim/clsClaimTask.vb
SAIF.Business.Tasks.Claim/clsMyTaskCollection.vb