---
title: Determine visible association types
summary: Computes the association types the current principal may see in the policy header.
status: draft
owner: SAIF Documentation Generation
last_reviewed: 2026-07-31
library: SAIF.Application.Policy
reference_type: package
operation_id: OP-05
trigger: Header settings or data provider requires validated association types
---

# Determine visible association types

This operation evaluates the full association-type list and returns only the types the current principal is allowed to see.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-05 |
| **Trigger** | `ValidatedAssociationTypes` is read by the header settings or header provider |
| **Inputs** | `DPI`, security principal |
| **Outputs** | Authorized set of `IPolicyAssociationType` values |
| **Primary components** | `clsPolicyHeaderSecurityManager.GetValidAssociationTypes` |
| **Entry point** | `Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb` |

## Steps

1. Load and cache the complete association-type set through `clsAssociationTypeFactory.GetAssociationTypes(DPI)`.
2. Classify the caller as internal or external based on `clsUserType(inSecurityPrincipal).IsSAIFEmployee`.
3. Evaluate each association type.
   - Unsecured types are always accessible.
   - Secured types require the principal to hold either `<SecurityGroupName>` for internal users or `<SecurityGroupName>Ext` for external users ([BR-112](../business-rules.md#br-112-secured-association-types-require-matching-resource)).
4. Return only the accessible types.

## Process flow

The following diagram visualizes association-type authorization.

```mermaid
flowchart TD
    Start([Validated types requested]) --> Load[Load all association types]
    Load --> Kind{Internal or external user?}
    Kind --> Eval[Evaluate each type]
    Eval --> Secured{Type secured?}
    Secured -->|No| Keep[Keep type]
    Secured -->|Yes| Check[Check matching resource]
    Check -->|Authorized| Keep
    Check -->|Unauthorized| Drop[Drop type]
    Keep --> Done([Return accessible set])
    Drop --> Done
```

## Failure and edge-case behavior
- The full association-type set is cached process-wide and does not show an invalidation path in the findings.*
- Concrete `SECURITY_GROUP_NAME` values come from data, not source, so the full dynamic resource inventory cannot be confirmed here.**

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with `**` could not be confirmed; treat as unknown until verified.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)

## Sources
- `Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb`