---
title: Load policy header and validate access
summary: Resolves the policy header, validates access, derives the parent account, and decides dropdown visibility.
status: draft
owner: SAIF IT Core Services
last_reviewed: 2026-10-12
library: BolMiddleware
reference_type: package
operation_id: OP-10
trigger: Handler execution on a BolPolicyModel page
---

# Load policy header and validate access

Pages that derive from `BolPolicyModel` show the policy header above their content. This operation runs around the consumer handler to resolve the header for the context policy and to expose the result flags the layout and consumer page use.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-10 |
| **Trigger** | Handler execution on a `BolPolicyModel` page |
| **Inputs** | Context policy number, current user |
| **Outputs** | `Header`, `AccessAllowed`, `ErrorMessage`, `ParentAccount`, `ShowPolicyDropdown` |
| **Primary components** | `BolPolicyModel.OnPageHandlerExecuting`, `BolPolicyModel.OnPageHandlerExecuted`, `BolPolicyModel.CanViewPolicyDropdown` |
| **Entry point** | `src/BolMiddleware/Models/BolPolicyModel.cs` |

## Steps

1. If the posted `contextvalue` is non-empty, reset `ParentAccount` to zero and store `0` as the `ParentAccount` context value; otherwise leave it ([BR-BOLMIDDLEWARE-010](../business-rules.md#br-bolmiddleware-010-parent-account-reset)). A stored `ParentAccount` greater than zero is then restored from the context value.
2. If the context has a policy number, run [Resolve policy header](resolve-policy-header.md) ([BR-BOLMIDDLEWARE-014](../business-rules.md#br-bolmiddleware-014-session-policy-header-reuse), [BR-BOLMIDDLEWARE-009](../business-rules.md#br-bolmiddleware-009-policy-access-validation)).
3. When a new header is loaded and `ParentAccount` is zero, derive `ParentAccount` from the relationship policy, or from the rate account when no relationship policy exists ([BR-BOLMIDDLEWARE-011](../business-rules.md#br-bolmiddleware-011-parent-account-derivation)).
4. Set `ShowPolicyDropdown` through `CanViewPolicyDropdown`, which requires at least one association plus an external or internal predicate: an external user needs a `CustomerId` equal to the relationship policy or rate account (or a `ManualAffiliation` association with `CustomerId` equal to `ParentAccount`); an internal user needs the policy or parent account to equal the relationship policy or rate account ([BR-BOLMIDDLEWARE-012](../business-rules.md#br-bolmiddleware-012-policy-dropdown-visibility)).
5. Validate access, then call the virtual `OnRequestStart` hook. After the handler completes, `OnPageHandlerExecuted` calls the virtual `OnRequestEnd` hook.
   - On a failed access check: `ErrorMessage` is set and the view components show the error view.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Handler executing]) --> D0{contextvalue posted?}
	D0 -->|Yes| S1[Reset ParentAccount to zero]
	D0 -->|No| S1b[Keep stored ParentAccount]
	S1 --> D1{Policy number in context?}
	S1b --> D1
	D1 -->|No| EndSkip([Handler runs without header])
	D1 -->|Yes| S3[Resolve policy header]
	S3 --> S4[Derive ParentAccount if zero]
	S4 --> S5[Set ShowPolicyDropdown]
	S5 --> S6[Validate access then OnRequestStart]
	S6 --> EndOk(["Handler runs, then OnRequestEnd"])
```

## Failure and edge-case behavior

- Access validation reads `Task.Result` on an async call, which blocks a request thread and can deadlock in a synchronization context.
- The handler still runs when access is denied; derived pages must check `AccessAllowed` themselves.
- Exception messages are stored in `ErrorMessage` and displayed to the user.

## Related documentation
- [Index](../index.md)
- [Overview](../overview.md)
- [Architecture](../architecture.md)
- [Dependencies](../dependencies.md)
- [Configuration](../configuration.md)
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Security and authorization](../security-authorization.md)
- [Service registration](../service-registration.md)
- [API reference](../api/index.md)

## Sources
- src/BolMiddleware/Models/BolPolicyModel.cs
- src/BolMiddleware/Services/Security/SecurityService.cs