SAIF.Application.Claim security and authorization¶

This page documents the authorization patterns implemented by SAIF.Application.Claim.

Authorization architecture¶

Claim authorization is evaluated locally through ClaimUserAccess, ClaimSecurity, and the base application manager before application-specific retrieval continues.

flowchart TD
    Caller[Calling code] --> AppMgr[ClaimAppManager]
    AppMgr --> Access[ClaimUserAccess]
    AppMgr --> Security[ClaimSecurity]
    Security --> Claim[Claim data]
    AppMgr --> Override[ClaimServices override check]

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`SecureClaim`	Determines access to hostile or secure claims.	`ClaimUserAccess.SecureClaimAccess`	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`
`ConflictClaim`	Determines access to worker-conflict claims.	`ClaimUserAccess.ConflictAccess`	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`
`ExposureClaim`	Determines access to exposure claims.	`ClaimUserAccess.ExposureAccess`	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`
`CollateralHealthClaim`	Defines the named health-issue resource exposed by `ClaimUserAccess`.	`ClaimUserAccess.HealthIssueAccess`	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`

Authorization enforcement points¶

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`ClaimUserAccess`	`SecureClaimAccess`	`SecureClaim`	`HasAccess`	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`
`ClaimUserAccess`	`ConflictAccess`	`ConflictClaim`	`HasAccess`	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`
`ClaimUserAccess`	`ExposureAccess`	`ExposureClaim`	`HasAccess`	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`
`ClaimUserAccess`	`HealthIssueAccess`	`CollateralHealthClaim`	`HasAccess`	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`
`ClaimUserAccess`	`New(clsSecurityPrincipal, ParamArray AccessRights())`	`Caller-supplied resource names`	`CheckAccess`	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`
`ClaimSecurity`	`CheckClaim(clsClaimData)`	`ConflictClaim`, `ExposureClaim`, `SecureClaim`	`Composite claim-scope evaluation`	`Application\SAIF.Application.Claim\ClaimSecurity.vb`
`ClaimAppManager`	`CheckForSecurityOverride()`	`Claim-specific override`	`ClaimServices.HasOverrideAcess`	`Application\SAIF.Application.Claim\ClaimAppManager.vb`

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Claim	`ClaimSecurity.CheckClaim(clsClaimData)`	Evaluates claim flags (`IsWorkerConflict`, `IsExposure`, `IsHealthIssue`, `IsHostileWorker`) against the current user's cached AD-resource access to derive per-claim access outcomes.	`Application\SAIF.Application.Claim\ClaimSecurity.vb`
Claim override	`ClaimAppManager.CheckForSecurityOverride()` → `ClaimServices.HasOverrideAcess(...)`	Runs the SQL-backed exception check against `CL_SECURITY_OVERRIDE` joined to `ADP_VIRTUAL_EMPLOYEE_VIEW`, filtered by `ClaimID`, `USER_ID`, and effective date range.	`Application\SAIF.Application.Claim\ClaimAppManager.vb`; `Business\SAIF.Business\ClaimServices.vb`

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`ClaimUserAccess`	Wraps claim-domain AD-resource checks.	`ClaimSecurity`, consuming application managers	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`
`ClaimSecurity`	Computes claim-specific access outcomes.	`ClaimAppManager`	`Application\SAIF.Application.Claim\ClaimSecurity.vb`

Inherited security¶

From `UserAccess` (`SAIF.Application`)¶

Field	Value
Mechanism	`ClaimUserAccess` inherits `UserAccess.HasAccess`, which caches per-resource decisions and delegates uncached checks to `clsSecurityPrincipal.IsAuthorized`.
Enforcement	Claim-specific properties wrap `HasAccess` for the four claim-domain resource names.
Origin	`SAIF.Application` — `UserAccess`
Source	`Application\SAIF.Application.Claim\ClaimUserAccess.vb`; `Application\SAIF.Application\UserAccess.vb`

Notes¶

AD resource names are documented without environment suffixes.

Sources¶

Application\SAIF.Application.Claim\ClaimAppManager.vb
Application\SAIF.Application.Claim\ClaimSecurity.vb
Application\SAIF.Application.Claim\ClaimUserAccess.vb
Application\SAIF.Application\UserAccess.vb
Business\SAIF.Business\ClaimServices.vb