SAIF.Business.View.Policy security and authorization¶

This page documents authorization mechanisms implemented or consumed by this library. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a WindowsIdentity on the request context.

Authorization architecture¶

Authorization is centralized in clsPolicySecurity, which applies a two-tier decision for policy access: a coarse Active Directory gate for secure SAIF policies, followed by a user-type-specific authorization matrix that evaluates direct ownership, group membership, auditor assignment, loss-control assignment, or parent-policy fallback. The implementation splits enforcement across Oracle for auditor checks and SQL Server BDS for group, loss-control, and agent policy-list lookups.

flowchart TD
    Caller[Calling code] --> Gate{Secure policy?}
    Gate -- No --> Matrix["Per-user-type authorization<br>matrix"]
    Gate -- Yes --> AD[AD resource check<br>SAIFpolicyInfo]
    AD -- Deny --> Denied[Access denied]
    AD -- Allow --> Matrix
    Matrix --> Oracle[Oracle engine<br>auditor checks]
    Matrix --> BDS[SQL Server BDS engine<br>group, loss-control, agent checks]
    Matrix --> Parent[Parent-policy fallback<br>for policyholders]
    Oracle --> Decision{Authorized?}
    BDS --> Decision
    Parent --> Decision
    Decision -- Yes --> Allowed[Access allowed]
    Decision -- No --> Denied

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`SAIFpolicyInfo`	Grants access to policies flagged with the SAIF secure policy code	`clsPolicySecurity.IsPolicyValidForUser`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`

Authorization enforcement points¶

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`clsPolicySecurity`	`IsPolicyValidForUser(ByRef inPolicyData As clsPolicyData)`	Policy visibility decision	`HasAccess`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsPolicySecurity`	`IsPolicyValidForUser(ByRef inPolicyData As clsPolicyData)`	`SAIFpolicyInfo`	`IsAuthorized`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsPolicySecurity`	`IsPolicyValidForUser(ByVal inPolicyNum As Decimal)`	Policy visibility decision	`HasAccess`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsPolicySecurity`	`IsPolicyValidForParentPolicy`	Parent policyholder relationship	`HasAccess`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsPolicySecurity`	`CanSafetyConsultantAccessPolicy`	Loss-control consultant assignment	`HasAccess`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsPolicySecurity`	`CanAuditorAccessPolicy`	Auditor vendor assignment within the 60-day window	`HasAccess`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsPolicySecurity`	`IsInGroup`	Group / chapter membership	`HasAccess`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsPolicySecurity`	`PolicyList`	User-selectable accessible policy set	`HasAccess`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsPolicySecurity`	`ConvertUserTypeToUserAccessLevel`	Demo vs. non-demo access tiering	`HasAccess`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`

User-type authorization matrix¶

User type	Authorization rule	Related business rules	Source
SAIF employee	Always allowed after the secure-policy AD gate	BR-VP-003: Secure policy requires AD authorization, BR-VP-005: Access granted per user-access-level matrix	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
MCO	Always allowed after the secure-policy AD gate	BR-VP-003: Secure policy requires AD authorization, BR-VP-005: Access granted per user-access-level matrix	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
Medical provider	Always allowed after the secure-policy AD gate	BR-VP-003: Secure policy requires AD authorization, BR-VP-005: Access granted per user-access-level matrix	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
Bookkeeper	Always allowed after the secure-policy AD gate	BR-VP-003: Secure policy requires AD authorization, BR-VP-005: Access granted per user-access-level matrix	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
Agent / DemoAgent	User number must match `AgentNum` or `AgencySeqNum` on the policy	BR-VP-005: Access granted per user-access-level matrix	`SAIF.Business.View.Policy/clsPolicySecurity.vb`, `SAIF.Business.View.Policy/clsPolicyData.vb`, `SAIF.Business.View.Policy/clsAgency.vb`
Policyholder / DemoPolicyholder	Direct policy match or parent-policy fallback association is required	BR-VP-004: Invalid or zero policy number is never valid, BR-VP-005: Access granted per user-access-level matrix, BR-VP-009: Fallback to parent-policy authorization	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
Group / DemoGroup	Group/chapter lookup in BDS must confirm policy membership	BR-VP-005: Access granted per user-access-level matrix	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
Loss control / DemoLossControl	Team-assignment user name prefix must match, with `UserIdName` used for demo users	BR-VP-005: Access granted per user-access-level matrix, BR-VP-007: Loss control prefix match, BR-VP-008: Demo loss control matched on UserIdName	`SAIF.Business.View.Policy/clsPolicySecurity.vb`, `SAIF.Business.View.Policy/clsTeamAssignment.vb`
Auditor / DemoAuditor	Auditor vendor must be attached to an eligible audit within the 60-day window	BR-VP-005: Access granted per user-access-level matrix, BR-VP-006: Auditor 60-day access window	`SAIF.Business.View.Policy/clsPolicySecurity.vb`, `SAIF.Business.View.Policy/clsPolicyData.vb`
Quick-file user	No branch grants access, so access is denied	BR-VP-005: Access granted per user-access-level matrix	`SAIF.Business.View.Policy/clsPolicySecurity.vb`

Access-level ordinals¶

Access level	Ordinal	Purpose	Source
`SAIFEmployee`	1000	Highest internal policy-view tier	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`Auditor`	900	Standard auditor tier	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`DemoAuditor`	850	Demo auditor tier for masked views	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`Losscontrol`	800	Standard loss-control tier	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`DemoLossControl`	750	Demo loss-control tier for masked views	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`Agent`	700	Standard agent tier	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`DemoAgent`	650	Demo agent tier for masked views	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`Group`	600	Standard group tier	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`DemoGroup`	550	Demo group tier for masked views	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`Policyholder`	500	Standard policyholder tier	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`DemoPolicyholder`	450	Demo policyholder tier for masked views	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`QuickFileUser`	300	Lowest tier; used to detect reduced access behavior	`SAIF.Business.View.Policy/clsPolicySecurity.vb`

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Policy	`clsPolicySecurity.IsPolicyValidForUser`	Secure-policy AD gate plus user-type matrix	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
Policyholder parent relationship	`clsPolicySecurity.IsPolicyValidForParentPolicy`	Parent-policy association fallback for policyholders	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
Loss-control assignment	`clsPolicySecurity.CanSafetyConsultantAccessPolicy`	Prefix comparison against team assignment identity	`SAIF.Business.View.Policy/clsPolicySecurity.vb`, `SAIF.Business.View.Policy/clsTeamAssignment.vb`
Auditor assignment	`clsPolicySecurity.CanAuditorAccessPolicy`	Oracle count query across `PA_AUDIT`, `PA_AUDITOR`, and `PA_POLICY_PERIOD`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
Demo data masking	`clsPolicyData.IsDemoUser`, object-level `MaskData` properties	Presentation-side masking with `clsConstants.DataMaskingConstants`	`SAIF.Business.View.Policy/clsPolicyData.vb`, `SAIF.Business.View.Policy/clsPolicyAddress.vb`, `SAIF.Business.View.Policy/clsAgency.vb`, `SAIF.Business.View.Policy/clsTeamAssignment.vb`

Demo users see masked policy, address, agency, and team-assignment data per BR-VP-010: Demo users see masked data. The masking occurs after data retrieval, so raw values still travel from the database into process memory before the library rewrites presentation-facing fields.

Segregation of duties¶

No segregation-of-duties rules were found. This is consistent with the library's read-only design and BR-VP-027: Create/Insert/Update/Delete SQL are invalid.

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`clsPolicySecurity`	Central authorization service for policy-scoped access decisions and accessible policy lists	Calling business/view code*	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`IPolicySecurityDataProvider`	Unimplemented abstraction for supplying policy-security fields independently of `clsPolicyData`*	No implementers found in this repository*	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsSecurityPrincipal`	Ambient identity and authorization dependency supplying user type, user number, user name, group chapter, and AD checks	`clsPolicySecurity`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`
`clsUserType`	Maps security-principal context into application user categories and demo flags	`clsPolicySecurity`	`SAIF.Business.View.Policy/clsPolicySecurity.vb`

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources¶

SAIF.Business.View.Policy/clsAgency.vb
SAIF.Business.View.Policy/clsPolicyAddress.vb
SAIF.Business.View.Policy/clsPolicyData.vb
SAIF.Business.View.Policy/clsPolicySecurity.vb
SAIF.Business.View.Policy/clsTeamAssignment.vb