SAIF.Application.Policy security and authorization¶

This page documents the mixed authorization model implemented by SAIF.Application.Policy. The library classifies user roles with local IsAuthorized and domain checks, delegates per-policy authorization to SAIF.Business.View.Policy, and filters policy-header association types and association rows before rendering.

Authorization architecture¶

Authorization is split across two local managers and one delegated dependency. clsPolicySecurity classifies the current principal into policy-facing roles; clsPolicyHeaderSecurityManager computes which association types and association rows the principal may see; and PolicyAppManager.UserCanAccessPolicy delegates policy-level access control to SAIF.Business.View.Policy.clsPolicySecurity except when HttpContext.Current Is Nothing, where the application layer grants access unconditionally. The library also applies three demo-masking gates and two visibility gates after authorization decisions have been made.

flowchart TD
    Caller[Calling application] --> Manager[PolicyAppManager]
    Manager --> LocalRoles[clsPolicySecurity]
    Manager --> ViewSecurity[View.Policy clsPolicySecurity]
    Manager --> HeaderSecurity[clsPolicyHeaderSecurityManager]
    HeaderSecurity --> AssocTypes[Association type security]
    HeaderSecurity --> AssocRows[Association row filtering]
    Manager --> HeaderProvider[clsStandardPolicyHeaderDataProvider]
    HeaderProvider --> Visibility[Demo and field visibility gates]

AD resource catalog¶

Resource name	Purpose	Enforcement point	Source
`AgencyExternal`	Marks an external agency user and contributes to agent status	`clsPolicySecurity.IsAgent`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`ARPAgencyExternal`	Marks an assigned-risk-plan agency user and contributes to agent status	`clsPolicySecurity.IsAgent`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`ProducerExternal`	Marks a producer and contributes to agent status	`clsPolicySecurity.IsProducer` / `IsAgent`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`AuditorExternal`	Marks an external fee auditor	`clsPolicySecurity.IsAuditorUser`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`BusinessOnlineDemo`	Marks a demo user and enables masking	`clsPolicySecurity.IsDemoUser`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`GroupsOnlineExternal`	Marks a group user	`clsPolicySecurity.IsGroupUser`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`LossControlExternal`	Marks an external loss-control consultant	`clsPolicySecurity.IsLossControlUser`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`DivPolicyholderExternal`	Marks an external policyholder	`clsPolicySecurity.IsPolicyHolder`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`PolicyPayrollQuickFileExternal`	Marks a payroll quick-file user	`clsPolicySecurity.IsQuickFileUser`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`UWQuoteUser`	Declared underwriting-quote resource constant that is not consumed by compiled code*	`clsPolicySecurity` constant only	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`<SecurityGroupName>`	Internal-user access to a secured association type	`clsPolicyHeaderSecurityManager`	`Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb`
`<SecurityGroupName>Ext`	External-user access to a secured association type	`clsPolicyHeaderSecurityManager`	`Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb`

Authorization enforcement points¶

Attribute-based authorization¶

No attribute-based authorization is implemented in this library.

Programmatic authorization checks¶

Class	Method	Resource / Role	Check type	Source
`clsPolicySecurity`	`IsAgent`	`AgencyExternal`, `ProducerExternal`, `ARPAgencyExternal`	`IsAuthorized` and delegated property composition	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsProducer`	`ProducerExternal`	`IsAuthorized`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsAuditorUser`	`AuditorExternal`	`IsAuthorized`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsDemoUser`	`BusinessOnlineDemo`	`IsAuthorized`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsGroupUser`	`GroupsOnlineExternal`	`IsAuthorized`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsLossControlUser`	`LossControlExternal`	`IsAuthorized`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsPolicyHolder`	`DivPolicyholderExternal`	`IsAuthorized`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsQuickFileUser`	`PolicyPayrollQuickFileExternal`	`IsAuthorized`	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`clsPolicySecurity`	`IsSAIFEmployee`	Domain `SAIF`	Identity comparison	`Application\SAIF.Application.Policy\clsPolicySecurity.vb`
`clsPolicyHeaderSecurityManager`	`ValidatedUserAssociationType`	`<SecurityGroupName>` / `<SecurityGroupName>Ext`	`IsAuthorized`	`Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb`
`PolicyAppManager`	`UserCanAccessPolicy`	Delegated policy-level access decision	Dependency call or unconditional allow	`Application\SAIF.Application.Policy\PolicyAppManager.vb`
`PolicyAppManager`	`OnRetrieve`	Access outcome application	Context/no-access/message update	`Application\SAIF.Application.Policy\PolicyAppManager.vb`

Data-level authorization¶

Entity type	Validation method	Mechanism	Source
Policy	`PolicyAppManager.UserCanAccessPolicy`	Delegates to `SAIF.Business.View.Policy.clsPolicySecurity.IsPolicyValidForUser(PolicyData)`; returns `True` unconditionally when `HttpContext.Current Is Nothing`	`Application\SAIF.Application.Policy\PolicyAppManager.vb`
Policy association type	`clsPolicyHeaderSecurityManager.GetValidAssociationTypes`	Secured types require the principal to hold the matching internal or external security-group resource	`Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb`
Policy header association row (policyholder)	`clsPolicyHeaderSecurityManager.FilterAssociationsByUserType`	Keep only association types where the user's own policy is the parent	`Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb`
Policy header association row (agent)	`clsPolicyHeaderSecurityManager.FilterAssociationsByUserType`	Keep only rows whose `AgentNumber` or `AgencySeqNum` matches the user's number	`Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb`

Security interfaces and contracts¶

Interface / Class	Role	Consumers	Source
`clsSecurityPrincipal`	Ambient authorization and identity service used by both local security managers	`PolicyAppManager`, `clsPolicySecurity`, `clsPolicyHeaderSecurityManager`, `clsStandardPolicyHeaderSettings`, `clsStandardPolicyHeaderDataProvider`	`Application\SAIF.Application.Policy\PolicyAppManager.vb`
`IPolicyHeaderSettings`	Contract for security-filtered header settings and visibility flags	`PolicyAppManager`, header consumers	`Application\SAIF.Application.Policy\PolicyAppManager.vb`
`IApplicationTestInformationProvider`	Contract for diagnostic test-information values shown outside production	`clsStandardPolicyHeaderSettings` consumers	`Application\SAIF.Application.Policy\PolicyAppManager.vb`
`SAIF.Business.View.Policy.clsPolicySecurity`	Delegated policy-level authorization dependency	`PolicyAppManager`	`Application\SAIF.Application.Policy\PolicyAppManager.vb`

Security risks and open questions¶

Clear risk — HttpContext bypass. UserCanAccessPolicy grants access unconditionally when HttpContext.Current Is Nothing, so non-web hosts bypass authorization. This risk is explicit and unresolved.
Clear risk — process-wide Shared authorization caches never invalidate. Association types, resolved user numbers, and per-user validated association types are cached in Shared collections with no observed invalidation strategy beyond process recycling.*
Clear risk — fixed Oracle DB user GEN. DataLayer.DBUser = "GEN" means database-level access cannot distinguish callers, so the data-layer identity used during authorization-adjacent reads is fixed for every user.
Clear risk — empty OnCheckSecurity override. PolicyAppManager.OnCheckSecurity has an empty body, leaving OnRetrieve as the effective application-level security hook and raising an unresolved gap question for derived hosts.**
RateAccountNumber and RelationshipDescription read the unfiltered association set rather than ValidatedAssociations; whether those values were intentionally left outside row-level filtering could not be confirmed.**
The runtime dependency version of SAIF.Business.View.Policy is a 1.x package, while the documented library in this run is a 2.x codebase, so delegated authorization behavior may drift across versions.**

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources¶

Application\SAIF.Application.Policy\PolicyAppManager.vb
Application\SAIF.Application.Policy\clsPolicySecurity.vb
Application\SAIF.Application.Policy\PolicyHeader\clsPolicyHeaderSecurityManager.vb
Application\SAIF.Application.Policy\PolicyHeader\clsStandardPolicyHeaderDataProvider.vb
Application\SAIF.Application.Policy\PolicyHeader\clsStandardPolicyHeaderSettings.vb
Business\SAIF.Business.View.Policy\clsPolicySecurity.vb