---
title: SAIF.Business security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control.
status: draft
owner: SAIF
last_reviewed: 2026-07-24
library: SAIF.Business
reference_type: package
---

# SAIF.Business security and authorization

This page documents authorization mechanisms implemented or consumed by `SAIF.Business`. Authentication is handled by surrounding infrastructure; the library itself implements only authorization, resource checks, and claim-scoped access rules.

## Authorization architecture

`ClaimServices`, `ImageServices`, `clsUserType`, and `ObjectServices` use `clsSecurityPrincipal` and related framework helpers to evaluate AD resources, role membership, and mail-id-scoped access. Claim-facing flows add claim-security data from `clsClaimSecurity` plus a SQL-based override path so access decisions combine directory authorization and claim-specific data.

```mermaid
flowchart TD
    Caller[Calling code] --> ClaimSvc[ClaimServices / ImageServices]
    ClaimSvc --> Flags[clsClaimSecurity]
    ClaimSvc --> Sec[clsSecurityPrincipal]
    ClaimSvc --> Sql[(Oracle override lookup)]
    Sec --> AD[(Active Directory)]
    Flags --> ClaimApi[CCClaimData API]
```

## AD resource catalog

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `CollateralHealthClaim` | Grants access to view/handle claims flagged with a collateral health issue | `ClaimServices.setImageHealthIssueSecurity → SecurityPrincipal.IsAuthorized("CollateralHealthClaim"); HasHealthIssueAccess → ResourceAccessValid; HasHealthIssueAccessCached → ResourceAccessValidCached` | `Business\SAIF.Business\ClaimServices.vb (lines 586, 873, 894)` |
| `ConflictClaim` | Grants access to worker-conflict-flagged claims | `ClaimServices conflict-security methods → IsAuthorized/ResourceAccessValid/ResourceAccessValidCached("ConflictClaim")` | `Business\SAIF.Business\ClaimServices.vb (lines 917, 938, 959)` |
| `ExposureClaim` | Grants access to claims flagged as an "exposure" claim | `ClaimServices exposure-security methods → IsAuthorized/ResourceAccessValid/ResourceAccessValidCached("ExposureClaim")` | `Business\SAIF.Business\ClaimServices.vb (lines 979, 1000, 1021)` |
| `Image` | Grants access to secured document-imaging content for a claim | `ClaimServices image-security methods → IsAuthorized/ResourceAccessValid/ResourceAccessValidCached("Image"); also ImageServices.HasAccessToClaim → ResourceAccessValidCached(inMailid, "Image")` | `Business\SAIF.Business\ClaimServices.vb (lines 1041, 1062, 1083); Business\SAIF.Business\ImageServices.vb (line 486)` |
| `SecureClaim` | Grants access to claims involving a hostile worker | `ClaimServices hostile-worker-security methods → IsAuthorized/ResourceAccessValid/ResourceAccessValidCached("SecureClaim")` | `Business\SAIF.Business\ClaimServices.vb (lines 1103, 1124, 1145)` |
| `DMClaimUnsecured` | Document-management claim-document access (unsecured tier) | `ImageServices.HasAccessToClaim → mySecuritySystem.ResourceAccessValidCached(inMailid, "DMClaimUnsecured")` | `Business\SAIF.Business\ImageServices.vb (line 392)` |
| `DMEAIPUnsecured` | Document-management EAIP-document access (unsecured tier) | `ImageServices.HasAccessToClaim → ResourceAccessValidCached(inMailid, "DMEAIPUnsecured")` | `Business\SAIF.Business\ImageServices.vb (line 404)` |
| `DMPolicyUnSecured` | Document-management policy-document access (unsecured tier) | `ImageServices.HasAccessToClaim → ResourceAccessValidCached(inMailid, "DMPolicyUnSecured") (OR'd with DMPolicySecured)` | `Business\SAIF.Business\ImageServices.vb (line 435)` |
| `DMPolicySecured` | Document-management policy-document access (secured tier) | `ImageServices.HasAccessToClaim → ResourceAccessValidCached(inMailid, "DMPolicySecured")` | `Business\SAIF.Business\ImageServices.vb (line 435)` |
| `AgencyExternal (constant AGENT_USER)` | External agent user classification | `clsUserType.IsAgent → SecurityPrincipal.IsAuthorized(AGENT_USER) (comment notes legacy AD group name "Agents")*` | `Business\SAIF.Business\clsUserType.vb (lines 12, 66)` |
| `ARPAgencyExternal (constant ARP_AGENT_USER)` | External ARP-agent user classification | `clsUserType.IsAgent (OR condition) → SecurityPrincipal.IsAuthorized(ARP_AGENT_USER) (legacy AD group "ARPAgents")*` | `Business\SAIF.Business\clsUserType.vb (lines 13, 68)` |
| `AuditorExternal (constant AUDITOR_USER)` | External fee-auditor user classification | `clsUserType.IsAuditorUser → SecurityPrincipal.IsAuthorized(AUDITOR_USER) (legacy AD group "FeeAuditors")*` | `Business\SAIF.Business\clsUserType.vb (lines 14, 78)` |
| `DemoUser (constant DEMO_USER)` | Demo-account user classification | `clsUserType.IsDemoUser → SecurityPrincipal.IsAuthorized(DEMO_USER) (legacy AD group "DemoUsers")*` | `Business\SAIF.Business\clsUserType.vb (lines 15, 88)` |
| `GroupsOnlineExternal (constant GROUP_USER)` | External "Group" (employer group) user classification | `clsUserType.IsGroupUser → SecurityPrincipal.IsAuthorized(GROUP_USER) (legacy AD group "Groups")*` | `Business\SAIF.Business\clsUserType.vb (lines 16, 98)` |
| `LossControlExternal (constant LOSS_CONTROL_USER)` | External Loss Control user classification | `clsUserType.IsLossControlUser → SecurityPrincipal.IsAuthorized(LOSS_CONTROL_USER) (legacy AD group "Loss Control")*` | `Business\SAIF.Business\clsUserType.vb (lines 17, 108)` |
| `ClaimProfileExternalPolicyholder (constant POLICYHOLDER_USER)` | External policyholder user classification | `clsUserType.IsPolicyHolder → SecurityPrincipal.IsAuthorized(POLICYHOLDER_USER)` | `Business\SAIF.Business\clsUserType.vb (lines 18, 138)` |
| `ProducerExternal (constant PRODUCER_USER)` | External producer user classification | `clsUserType.IsProducer → SecurityPrincipal.IsAuthorized(PRODUCER_USER) (legacy AD group "Producers")*` | `Business\SAIF.Business\clsUserType.vb (lines 19, 164)` |
| `PolicyPayrollQuickFileExternal (constant QUICK_FILE_USER)` | External "Quick File" payroll user classification | `clsUserType.IsQuickFileUser → SecurityPrincipal.IsAuthorized(QUICK_FILE_USER) (legacy AD group "QuickFileUser")*` | `Business\SAIF.Business\clsUserType.vb (lines 20, 148)` |
| `UWQuoteUser (constant UWQUOTE_USER)` | Underwriting quote user classification | `Constant defined; no call site observed in scanned code — declared but not invoked via IsAuthorized/IsInRole in this library.**` | `Business\SAIF.Business\clsUserType.vb (line 21)` |
| `MedicalProvidersExternal (constant MEDICAL_PROVIDER_USER)` | External medical-provider user classification | `clsUserType.IsMedicalProvider → SecurityPrincipal.IsAuthorized(MEDICAL_PROVIDER_USER)` | `Business\SAIF.Business\clsUserType.vb (lines 22, 128)` |
| `MCO (constant MCO_USER)` | Managed Care Organization user classification | `clsUserType.IsMCOUser → SecurityPrincipal.IsInRole(MCO_USER) (note: uses IsInRole, not IsAuthorized, unlike all other clsUserType checks)*` | `Business\SAIF.Business\clsUserType.vb (lines 23, 118)` |
| `Caller-supplied resource (generic)` | Generic pass-through authorization/resource-access wrappers exposed for arbitrary resource names | `ObjectServices.IsAuthorized(inResource) → clsSecurityPrincipal.Instance.IsAuthorized(inResource); ObjectServices.HasResourceAccess(inMailid, inResource) → ResourceAccessValidCached; ObjectServices.HasResourceAccessExternal(inMailid, inResource) → ResourceAccessValidCachedExternal` | `Business\SAIF.Business\ObjectServices.vb (lines 108–170)` |


## Authorization enforcement points

No attribute-based authorization was detected in this library.

### Programmatic authorization checks

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `ClaimServices` | `setImageHealthIssueSecurity` | `CollateralHealthClaim` | `IsAuthorized` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasHealthIssueAccess` | `CollateralHealthClaim` | `ResourceAccessValid` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasHealthIssueAccessCached` | `CollateralHealthClaim` | `ResourceAccessValidCached` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `setConflictSecurity` | `ConflictClaim` | `IsAuthorized` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasConflictAccess` | `ConflictClaim` | `ResourceAccessValid` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasConflictAccessCached` | `ConflictClaim` | `ResourceAccessValidCached` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `setExposureSecurity` | `ExposureClaim` | `IsAuthorized` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasExposureAccess` | `ExposureClaim` | `ResourceAccessValid` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasExposureAccessCached` | `ExposureClaim` | `ResourceAccessValidCached` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `setImageSecurity` | `Image` | `IsAuthorized` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasImageAccess` | `Image` | `ResourceAccessValid` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasImageAccessCached` | `Image` | `ResourceAccessValidCached` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `setHostileWorkerSecurity` | `SecureClaim` | `IsAuthorized` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasHostileWorkerAccess` | `SecureClaim` | `ResourceAccessValid` | `Business\SAIF.Business\ClaimServices.vb` |
| `ClaimServices` | `HasHostileWorkerAccessCached` | `SecureClaim` | `ResourceAccessValidCached` | `Business\SAIF.Business\ClaimServices.vb` |
| `ImageServices` | `HasAccessToClaim` | `DMClaimUnsecured` | `ResourceAccessValidCached` | `Business\SAIF.Business\ImageServices.vb` |
| `ImageServices` | `HasAccessToClaim` | `DMEAIPUnsecured` | `ResourceAccessValidCached` | `Business\SAIF.Business\ImageServices.vb` |
| `ImageServices` | `HasAccessToClaim` | `DMPolicyUnSecured` | `ResourceAccessValidCached` | `Business\SAIF.Business\ImageServices.vb` |
| `ImageServices` | `HasAccessToClaim` | `DMPolicySecured` | `ResourceAccessValidCached` | `Business\SAIF.Business\ImageServices.vb` |
| `ImageServices` | `HasAccessToClaim` | `Image` | `ResourceAccessValidCached` | `Business\SAIF.Business\ImageServices.vb` |
| `clsUserType` | `IsAgent` | `AgencyExternal` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsAgent` | `ARPAgencyExternal` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsAuditorUser` | `AuditorExternal` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsDemoUser` | `DemoUser` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsGroupUser` | `GroupsOnlineExternal` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsLossControlUser` | `LossControlExternal` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsMedicalProvider` | `MedicalProvidersExternal` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsMCOUser` | `MCO` | `IsInRole` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsPolicyHolder` | `ClaimProfileExternalPolicyholder` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsProducer` | `ProducerExternal` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `clsUserType` | `IsQuickFileUser` | `PolicyPayrollQuickFileExternal` | `IsAuthorized` | `Business\SAIF.Business\clsUserType.vb` |
| `ObjectServices` | `IsAuthorized` | Caller-supplied resource | `IsAuthorized` | `Business\SAIF.Business\ObjectServices.vb` |
| `ObjectServices` | `HasResourceAccess` | Caller-supplied resource | `ResourceAccessValidCached` | `Business\SAIF.Business\ObjectServices.vb` |
| `ObjectServices` | `HasResourceAccessExternal` | Caller-supplied resource | `ResourceAccessValidCachedExternal` | `Business\SAIF.Business\ObjectServices.vb` |

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Claim (document images) | `ImageServices.HasAccessToClaim(inDataPortalInfo, inMailid, inClaimNum)` | Composite check: retrieves claim security flags via clsClaimSecurity, then evaluates DMClaimUnsecured/DMEAIPUnsecured/DMPolicyUnSecured/DMPolicySecured/Image AD-resource access via ResourceAccessValidCached, gated by the claim's specific health/conflict/exposure/hostile-worker flags | `Business\SAIF.Business\ImageServices.vb` |
| Claim | `ClaimServices.HasAccessToClaim(inDataPortalInfo, inClaimNum, inMailid) / HasAccessToClaimCached(...)` | Retrieves clsClaimSecurity for the claim (conflict/hostile-worker/exposure/health-issue flags) and combines the relevant AD-resource checks (ConflictClaim, SecureClaim, ExposureClaim, CollateralHealthClaim) with a fallback to HasOverrideAcess when the AD checks fail | `Business\SAIF.Business\ClaimServices.vb` |
| Claim (per-employee, per-claim override) | `ClaimServices.HasOverrideAcess(inDataPortalInfo, inClaimID, inMailid)` | SQL-based ownership/exception check against CL_SECURITY_OVERRIDE/ADP_VIRTUAL_EMPLOYEE_VIEW, scoped to the specific claim ID and mail ID, with an active date-range (EFF_DATE/EXP_DATE) condition | `Business\SAIF.Business\ClaimServices.vb` |
| Claim (Return-to-Work assignment) | `clsClaimSecurity.RTWAssignedToClaim(inDataPortalInfo, ...)` | SQL-based check (RTWSQL criteria route) determining whether an RTW (Return to Work) coordinator/case owner is assigned to the specific claim — a claim-scope enforcement/lookup rather than a raw AD-group gate | `Business\SAIF.Business\clsClaimSecurity.vb` |
| Claim | `ClaimServices.IsClaimAvailableExternalView (per Phase 1 analysis)` | Composite identity-attribute + claim-state check restricting external (policyholder/agent) visibility of a claim | `Business\SAIF.Business\ClaimServices.vb` |

## Segregation of duties

No segregation-of-duties checks were identified in the provided findings for this library.

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `clsSecurityPrincipal` | Current-user authorization and resource-access gateway. | `ClaimServices`, `clsUserType`, `ImageServices`, `ObjectServices` | `Business\SAIF.Business\ClaimServices.vb`; `Business\SAIF.Business\clsUserType.vb`; `Business\SAIF.Business\ImageServices.vb`; `Business\SAIF.Business\ObjectServices.vb` |
| `clsAccountMaintProxy` | Mail-id resource-access helper consumed by claim and imaging checks. | `ClaimServices`, `ImageServices` | `Business\SAIF.Business\ClaimServices.vb`; `Business\SAIF.Business\ImageServices.vb` |
| `clsClaimSecurity` / `clsClaimSecurityData` | Claim-security flag retrieval and claim-scope helper contract. | `ClaimServices`, `ImageServices` | `Business\SAIF.Business\clsClaimSecurity.vb`; `Business\SAIF.Business\CCClaimDataAPI\clsClaimSecurityData.vb` |

## Notes
- AD resource names listed here use the base names observed in code; runtime framework behavior appends environment-specific suffixes where applicable.*
- `UWQuoteUser` is declared in `clsUserType` but no active authorization call site was observed in the provided findings.**

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with `**` could not be confirmed; treat as unknown until verified.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [Procedures](procedures/index.md)
- [API reference](api/index.md)
- [Configuration](configuration.md)

## Sources
- `Business\SAIF.Business\ClaimServices.vb`
- `Business\SAIF.Business\clsClaimSecurity.vb`
- `Business\SAIF.Business\clsUserType.vb`
- `Business\SAIF.Business\ImageServices.vb`
- `Business\SAIF.Business\ObjectServices.vb`
- `Business\SAIF.Business\CCClaimDataAPI\clsClaimSecurityData.vb`