---
title: SAIF.Data security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control.
status: draft
owner: SAIF.Core documentation team
last_reviewed: 2026-09-24
library: SAIF.Data
reference_type: package
---

# SAIF.Data security and authorization

This page documents authorization mechanisms implemented or consumed by this library. SAIF.Data references and enforces no Active Directory resource names; its security relevance is entirely data-level (`saif-data-security-analysis.md`).

## Authorization architecture

SAIF.Data has no attribute-based or programmatic AD-role authorization of its own. It supplies data-level building blocks that a higher layer (chiefly `SAIF.Services`) combines into an authorization decision: a boolean claim-security-override check, entity/DTO fields carrying claim, image, note, and document confidentiality attributes, agency/producer/policy scoping filters for output documents, and the service-credential plumbing for its two outbound REST clients (`saif-data-security-analysis.md`).

```mermaid
flowchart TD
    Caller[SAIF.Services caller] --> Override["ClaimSecurityOverrideProvider.HasClaimSecurityOverride"]
    Override --> DB["(CL_SECURITY_OVERRIDE)"]
    Caller --> Flags["Confidentiality/conflict flags on<br>SecurityOverride, ClaimPerson,<br>InjuryClaim, ClaimHeaderData"]
    Caller --> Scoping["PolicyOutputDocumentExtensions<br>agency/producer/policy filters"]
    Flags --> Decision["SAIF.Services.Security.ClaimSecurityService<br>(combines flags with AD resources)"]
    Override --> Decision
```

## AD resource catalog

None found. A repository-wide scan of `Data/SAIF.Data/**/*.cs` for `IsInRole`, `PrincipalPermission`, `Authorize`, `WindowsIdentity`, `IPrincipal`, `Thread.CurrentPrincipal`, `SecurityService`, and `DirectoryServices` returned no matches in compiled code (`saif-data-security-analysis.md` AD group / resource catalog).

## Authorization enforcement points

None found. SAIF.Data is a class library with no controllers, actions, or authorization attributes, and no method grants or denies an operation based on AD membership (`saif-data-security-analysis.md` Authorization enforcement points).

## Data-level authorization

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| `SecurityOverride` (table `CL_SECURITY_OVERRIDE`) | `ClaimSecurityOverrideProvider.HasClaimSecurityOverride(long claimId, string employeeId)` | NHibernate LINQ `Any()` over rows where `ClaimId == claimId`, `EmplId == employeeId`, `EffDate <= DateTime.Today` and `ExpDate >= DateTime.Today`; returns true when an active, date-bounded override grants the employee access to the claim ([SD-BR-020](business-rules.md#sd-br-020-employee-has-claim-security-override-only-when-override-row-matches-claim-and-employee-within-effdate-to-expdate-window)) | `Data/SAIF.Data/Queries/Claims/ClaimSecurityOverrideProvider.cs`, `Data/SAIF.Data/Queries/IClaimSecurityOverrideProvider.cs` |
| Claim security attribute carriers: `SecurityOverride.IsWorkerConflict`/`HostileWorker`, `ClaimPerson.IsWorkerConflict`/`HostileWorker`, `InjuryClaim.IsSecured`/`IsRestricted`/`IsExternallyViewable`, `ClaimHeaderData.IsWorkerConflict`, `ClaimSecurity.HostileWorkerCode`/`WorkerConflictFlag` | Attribute carriers only; no validation method in this library | Flags are read from the database and surfaced to `SAIF.Services.Security.ClaimSecurityService.GetClaimSecurity`, which combines them with the `ConflictClaim` and `SecureClaim` AD resources* | `Data/SAIF.Data/Model/Claims/SecurityOverride/SecurityOverride.cs`, `Data/SAIF.Data/Model/Claims/ClaimPerson.cs`, `Data/SAIF.Data/Model/Claims/InjuryClaim.cs`, `Data/SAIF.Data/Model/Claims/Information/ClaimHeaderData.cs`, `Data/SAIF.Data/Model/Claims/Information/ClaimSecurity.cs` |
| `ImageFilterCriteria` (group images) | Criteria DTO: `CanUserSeeConfidentialImages`, `CanUserSeeDeletedImages` | The caller sets the flags from AD checks in `SAIF.Services`; the filter itself is applied in `SAIF.Data.NHibernate`'s `GroupImageRepository.GetFilteredImageGroups`. SAIF.Data only carries the flags | `Data/SAIF.Data/Model/Groups/ImageFilterCriteria.cs` |
| `PolicyOutputDocument` (agency/producer document visibility) | `PolicyOutputDocumentExtensions.AgencyViewable`, `AgencyInboxViewable`, `Released`, `ForAgency(agencyId)`, `ForProducer(producerId)`, `ForPolicyOrAccount(policyNumber, accountNumber)`, composed in `OutputDocumentQueryProvider.GetReleasedAgencyViewablePolicyOutputDocuments`, `GetHeldAndPendingAgencyViewablePolicyOutputDocuments`, `ReleasedAgencyInboxViewableQuery` | Query-scoping filters restricted to a caller-supplied agency id, producer id, or policy number; only document types flagged `IsAgencyViewable`/`IsAgencyInboxViewable` are returned. SAIF.Data does not verify that the current user belongs to that agency or policy* ([SD-BR-072](business-rules.md#sd-br-072-agency-sees-only-agency-viewable-and-inbox-viewable-documents)) | `Data/SAIF.Data/Queries/OutputDocuments/PolicyOutputDocumentExtensions.cs`, `Data/SAIF.Data/Queries/OutputDocuments/OutputDocumentQueryProvider.cs` |
| Claim bill queue (`ClaimBillQueueTask`) | `CCClaimApiService.GetNextClaimBillFromQueue(bool hasConflictAccess)` | The caller's conflict-claim access is passed to the Guidewire CC Claim Data API as a path segment (`PUT v1/BillEntryTaskProcess/NextBillFromQueue/{hasConflictAccess}`); the API decides server-side whether conflict-claim bills may be dequeued to this user** | `Data/SAIF.Data/Queries/Claims/CCClaimApiService.cs` |

Confidentiality flags that exist on entities but are not filtered anywhere in SAIF.Data: `Notepad.IsConfidential`, `NotepadType.IsConfidentialByDefault`, `DocumentImageTypeCode.IsConfidentialByDefault`, `OnBaseDocumentSubType.IsConfidentialByDefault`, `DocumentDetail.IS_CONFIDENTIAL_FLAG`, `ProviderTypeCode.IsServiceProviderRestricted`. `EbillQueryProvider.GetConfidentialBillAssignment()` returns the `CONF` assignment rule used to route confidential e-bills; it is a routing rule, not an access check (`saif-data-security-analysis.md`).

### Consumers of the data-level checks

| Consumer | Use | Source |
| --- | --- | --- |
| `ClaimInformationService` | Instantiates `ClaimSecurityOverrideProvider` and calls `HasClaimSecurityOverride(claimId, employee.Id)` | `Services/SAIF.Services/Claims/Information/ClaimInformationService.cs` |
| `TaskService`, `LegalTaskService` | Combine `IsWorkerConflict`/`IsSecureClaim` with the user's secure/conflict access | `Services/SAIF.Services/Claims/Tasks/TaskService.cs`, `Services/SAIF.Services/Legal/Tasks/LegalTaskService.cs` |

## Segregation of duties

None found. SAIF.Data has no `*SegregationOfDuties*`/`*SOD*` classes and no queries against `employee_access` or `menu_structure`. `EmployeeAuthorityLimit.AuthorizedByEmplid` and `EmployeeAuthorityPaymentLimitHistory.AuthorizedByEmplid` record who approved a payment-authority limit, but no rule in this library prevents a user from approving their own limit (`saif-data-security-analysis.md` Segregation of duties findings).

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `IClaimSecurityOverrideProvider` | Contract for the claim-security-override data-level check | `SAIF.Services.Claims.Information.ClaimInformationService` | `Data/SAIF.Data/Queries/IClaimSecurityOverrideProvider.cs` |
| `ImageFilterCriteria` | Carries caller-supplied confidential/deleted image visibility flags into `SAIF.Data.NHibernate` | `SAIF.Services.Groups.Imaging.ImageService` (via `GroupImageSecurityProvider`), `SAIF.Data.NHibernate.GroupImageRepository` | `Data/SAIF.Data/Model/Groups/ImageFilterCriteria.cs` |

## Machine/application authorization

No machine-account AD group validation was found. SAIF.Data authenticates itself to downstream APIs as an application using service credentials, recorded here for completeness (`saif-data-security-analysis.md` Machine/application authorization findings).

| Client | Credential source | Mechanism | Source |
| --- | --- | --- | --- |
| `MedicalBillingApiService` (via `SAIF.Data.Clients.HttpClientBase`) | Secure config setting `medicalbillingapi.creds`, decrypted with `IEnvironmentService.GetSecureConfigSetting(AuthKey, systemHash)`; hash from `SystemHashUtil.ComputeHash(SystemType, SystemName)` or `SystemHashUtil.Get(SystemType)` | `NetworkCredential(user, password)` on an `HttpClientHandler` after splitting the value on `\|` | `Data/SAIF.Data/Clients/HttpClientBase.cs`, `Data/SAIF.Data/Clients/MedicalBillingApiService.cs` |
| `CCClaimApiService` (via `SAIF.Data.Guidewire.Clients.HttpClientBase`) | None: `AuthKey => string.Empty` | No credentials are attached by this library; any authentication is handled by the Guidewire base class or the network** | `Data/SAIF.Data/Queries/Claims/CCClaimApiService.cs`, `Data/SAIF.Data.Guidewire/Clients/HttpClientBase.cs` |

No credential literal is present in source.

## Notes
- **Concern (Medium):** `HttpClientBase.GetAsyncCached` builds the cache key from type, URL, `ensureSuccess`, and body hash only. Responses are cached process-wide (default 30 s, from `SAIF.Data.Guidewire`'s `DataClientConfiguration`) with no per-user component in the key, so any per-user data-level filtering applied downstream of the API is not reflected in the cache*. Because the calls use a service credential rather than the end user's identity, the API cannot filter by user anyway; authorization must happen in the caller before the call (`Data/SAIF.Data/Clients/HttpClientBase.cs`).
- **Concern (Low):** `HttpClientBase.InitializeClient` splits the decrypted secure setting on `\|` and indexes `creds[1]` without a length check; a malformed secret throws `IndexOutOfRangeException` rather than a descriptive error (`Data/SAIF.Data/Clients/HttpClientBase.cs`).
- **Concern (Low):** `PolicyOutputDocumentExtensions.ForPolicyOrAccount` computes account-level documents but returns only policy-level documents (the concatenation is commented out). This narrows rather than widens visibility, so it is a functional defect, not an exposure ([SD-BR-074](business-rules.md#sd-br-074-policy-or-account-filter-returns-policy-docs-only-while-account-docs-remain-unused), `Data/SAIF.Data/Queries/OutputDocuments/PolicyOutputDocumentExtensions.cs`).
- **Concern (Informational):** Agency, producer, and policy scoping filters trust the ids passed in; ownership of those ids must be validated by the caller (for example `IPolicySecurityService` in SAIF.Services)* (`Data/SAIF.Data/Queries/OutputDocuments/OutputDocumentQueryProvider.cs`).
- **Concern (Informational):** `TestRepository/**` in-memory seed builders ship in the production assembly; they contain no credentials (`Data/SAIF.Data/TestRepository/`).
- Mark inferred statements with `*` and unknown statements with `**`. Do not use bold inline confidence labels.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Database tables](database-tables.md)
- [SQL catalog](sql/index.md)
- [API reference](api/index.md)

## Sources
- `Data/SAIF.Data/Queries/Claims/ClaimSecurityOverrideProvider.cs`
- `Data/SAIF.Data/Queries/IClaimSecurityOverrideProvider.cs`
- `Data/SAIF.Data/Queries/Claims/CCClaimApiService.cs`
- `Data/SAIF.Data/Queries/Claims/Ebilling/EbillQueryProvider.cs`
- `Data/SAIF.Data/Queries/OutputDocuments/PolicyOutputDocumentExtensions.cs`
- `Data/SAIF.Data/Queries/OutputDocuments/OutputDocumentQueryProvider.cs`
- `Data/SAIF.Data/Clients/HttpClientBase.cs`
- `Data/SAIF.Data/Clients/MedicalBillingApiService.cs`
- `Data/SAIF.Data/Model/Claims/SecurityOverride/SecurityOverride.cs`
- `Data/SAIF.Data/Model/Claims/ClaimPerson.cs`
- `Data/SAIF.Data/Model/Claims/InjuryClaim.cs`
- `Data/SAIF.Data/Model/Claims/Information/ClaimHeaderData.cs`
- `Data/SAIF.Data/Model/Claims/Information/ClaimSecurity.cs`
- `Data/SAIF.Data/Model/Claims/Authority/EmployeeAuthorityLimit.cs`
- `Data/SAIF.Data/Model/Claims/Authority/EmployeeAuthorityPaymentLimitHistory.cs`
- `Data/SAIF.Data/Model/Groups/ImageFilterCriteria.cs`
- `Data/SAIF.Data/Model/Notes/Notepad.cs`
- `Data/SAIF.Data/Model/Notes/NotepadType.cs`
- `Data/SAIF.Data/Model/Documents/DocumentImageTypeCode.cs`
- `Data/SAIF.Data/Model/Documents/DocumentDetail.cs`
- `Data/SAIF.Data/Model/Imaging/OnBaseDocumentSubType.cs`
- `Data/SAIF.Data/Model/Providers/ProviderTypeCode.cs`
- `Data/SAIF.Data.Guidewire/Clients/HttpClientBase.cs`
- `Services/SAIF.Services/Claims/Information/ClaimInformationService.cs`
- `Services/SAIF.Services/Security/ClaimSecurityService.cs`
- `Services/SAIF.Services/Groups/Imaging/ImageService.cs`
- `Services/SAIF.Services/Claims/Tasks/TaskService.cs`
- `Services/SAIF.Services/Legal/Tasks/LegalTaskService.cs`