---
title: Classify principal roles
summary: Computes policy-facing role flags from authorization resources and authenticated domain.
status: draft
owner: SAIF Documentation Generation
last_reviewed: 2026-07-31
library: SAIF.Application.Policy
reference_type: package
operation_id: OP-08
trigger: First read of Security or any role property
---

# Classify principal roles

This operation evaluates the local authorization resources and identity attributes that `SAIF.Application.Policy` uses to classify a principal into policy-facing role flags.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-08 |
| **Trigger** | First read of `Security` or any role property |
| **Inputs** | `clsSecurityPrincipal` |
| **Outputs** | Cached role flags such as agent, producer, auditor, demo, and SAIF-employee |
| **Primary components** | `clsPolicySecurity` |
| **Entry point** | `Application\SAIF.Application.Policy\clsPolicySecurity.vb` |

## Steps

1. Capture the supplied `clsSecurityPrincipal` when the `clsPolicySecurity` instance is created.
2. For each role property, evaluate the needed `IsAuthorized` check once and cache the Boolean result.
3. Compute agent status as the inclusive combination of `AgencyExternal`, producer status, and `ARPAgencyExternal` ([BR-126](../business-rules.md#br-126-agent-status-comes-from-three-resource-paths)).
4. Compute SAIF-employee status from the principal's domain name rather than an authorization resource ([BR-127](../business-rules.md#br-127-saif-employee-status-comes-from-domain)).
5. Return the cached role flags to downstream consumers such as `PolicyAppManager` and header-security components.

## Process flow

The following diagram visualizes role classification.

```mermaid
flowchart TD
    Start([Role property requested]) --> Check{Cached already?}
    Check -->|Yes| Return([Return cached value])
    Check -->|No| Eval[Evaluate IsAuthorized or domain check]
    Eval --> Cache[Cache Boolean result]
    Cache --> Return
```

## Failure and edge-case behavior
- `UWQuoteUser` is declared but not consumed by the compiled role properties.*
- Role cache lifetime is tied to the `clsPolicySecurity` instance, not to the process as a whole.

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

## Sources
- `Application\SAIF.Application.Policy\clsPolicySecurity.vb`