---
title: SAIF.SAIFCode.Core security and authorization
summary: Authorization requirements, AD resource groups, security enforcement points, and data-level access control.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-09-24
library: SAIF.SAIFCode.Core
reference_type: package
---

# SAIF.SAIFCode.Core security and authorization

This page documents authorization mechanisms declared by this library and consumed elsewhere. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a `WindowsIdentity` on the request context. **SAIF.SAIFCode.Core declares 16 Active Directory resource-name constants and 9 security service contracts, but contains no enforcement code of its own: no `IsAuthorized` calls, no authorization attributes, no directory lookups.** Of the 16 constants, 6 have a compiled enforcement point in `SAIF.Services`, 6 are referenced only by uncompiled `NoteService.cs` files (excluded from the build and therefore not enforced), and 4 (all `ViewRole` constants) have no reference anywhere in the repository; this page traces each one to its enforcement point, or records that it has none in compiled code, and cross-references [`../saif-services/security-authorization.md`](../saif-services/security-authorization.md) for the implementations.

## Authorization architecture

Authorization in this library follows a declare-here, enforce-elsewhere pattern: AD resource-name constants and security service interfaces/DTOs are declared here, and `SAIF.Services` implementations perform the programmatic `IsAuthorized` checks against them via the external `IUserProfileService.GetCurrentUser().IsAuthorized(resource)` call*. No WCF `SecurityService` integration, service reference, client class, endpoint URL, or configuration key was found in this library or its `app.config` (binding redirects only).

```mermaid
flowchart TD
    Caller[Calling code in SAIF.Services] --> Resource["AD resource-name constant<br>(declared in SAIF.SAIFCode.Core)"]
    Resource --> Profile["IUserProfileService.GetCurrentUser()<br>(external, SAIF.Framework.Core)"]
    Profile --> IsAuth["IsAuthorized(resource)"]
    IsAuth -->     AD[("Active Directory")]
```

## AD resource catalog

**Full catalog of all 16 AD resource-name constants declared in this library.** All are `public const string` members of four `SecurityRoles` classes (all four files compiled). The environment suffix (`Resource`/`TestResource`) is not part of the literal and is appended at runtime by the external `IUserProfileService` implementation*. **Summary: 6 of 16 have a compiled enforcement point in this repository, 6 are referenced only by uncompiled `NoteService.cs` files, and 4 (all `ViewRole` constants) are never referenced anywhere in the repository.**

| Resource name | Purpose | Enforcement point | Source |
| --- | --- | --- | --- |
| `AgencyImagingView` | View agency images* | **None: no reference anywhere in the repository** | `Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs` |
| `AgencyImagingEdit` | Edit agency image metadata | `SAIF.Services.Agencies.Imaging.ImageService.CanUserEditImages`, checked in `EditImage` (compiled) — see [`../saif-services/security-authorization.md`](../saif-services/security-authorization.md) | `Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs` |
| `AgencyImagingConfidential` | See confidential agency images | `SAIF.Services.Agencies.Imaging.ImageService.CanUserSeeConfidentialImages` (compiled) — see [`../saif-services/security-authorization.md`](../saif-services/security-authorization.md) | `Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs` |
| `AgencyImagingDeleted` | See soft-deleted agency images (constant named `DeleteRole`, but used as a view-deleted permission) | `SAIF.Services.Agencies.Imaging.ImageService.CanUserSeeDeletedImages` (compiled) | `Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs` |
| `AgencyNotePadView` | View agency notepad entries* | **None: no reference anywhere in the repository** | `Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs` |
| `AgencyNotePadEdit` | Edit agency notes* | `Services/SAIF.Services/Agencies/Notes/NoteService.cs` (**not compiled** — excluded from `SAIF.Services.csproj`) | `Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs` |
| `AgencyNotePadDelete` | Delete agency notes* | `Services/SAIF.Services/Agencies/Notes/NoteService.cs` (**not compiled**) | `Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs` |
| `AgencyNotePadConfidential` | See confidential agency notes* | `Services/SAIF.Services/Agencies/Notes/NoteService.cs` (**not compiled**) | `Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs` |
| `GroupImagingView` | View group images* | **None: no reference anywhere in the repository** | `Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs` |
| `GroupImagingEdit` | Edit group images | `SAIF.Services.Groups.Imaging.GroupImageSecurityProvider.CanUserEditImages` (compiled) | `Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs` |
| `GroupImagingConfidential` | See confidential group images | `GroupImageSecurityProvider.CanUserSeeConfidentialImages` (compiled), feeding `ImageFilterCriteria.CanUserSeeConfidentialImages` for SAIF.Data.NHibernate `GroupImageRepository.GetFilteredImageGroups` | `Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs` |
| `GroupImagingDeleted` | See soft-deleted group images (same `DeleteRole` naming mismatch as the agency constant) | `GroupImageSecurityProvider.CanUserSeeDeletedImages` (compiled), feeding `ImageFilterCriteria.CanUserSeeDeletedImages` | `Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs` |
| `GroupNotePadView` | View group notepad entries* | **None: no reference anywhere in the repository** | `Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs` |
| `GroupNotePadEdit` | Edit group notes* | `Services/SAIF.Services/Groups/Notes/NoteService.cs` (**not compiled**) | `Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs` |
| `GroupNotePadDelete` | Delete group notes* | `Services/SAIF.Services/Groups/Notes/NoteService.cs` (**not compiled**) | `Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs` |
| `GroupNotePadConfidential` | See confidential group notes* | `Services/SAIF.Services/Groups/Notes/NoteService.cs` (**not compiled**) | `Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs` |

A repository-wide search for these literal values in `*.cs`, `*.cshtml`, `*.vb`, `*.config`, `*.json`, and `*.xml` returned only these definitions — no controller attribute or configuration entry uses them by value. Resource names used by the security service implementations themselves (for example `ConflictClaim`, `SecureClaim`, `SAIFPolicyInfo`, `AgencyExternal`) are defined in `SAIF.Services`, not in this library — see [`../saif-services/security-authorization.md`](../saif-services/security-authorization.md).

## Authorization enforcement points

### Attribute-based authorization

None. This library has no controllers or actions and declares no authorization attributes.

### Programmatic authorization checks

None in this library. The contracts declared here are implemented and enforced entirely in `SAIF.Services`, traced below for cross-reference — enforcement itself belongs to [`../saif-services/security-authorization.md`](../saif-services/security-authorization.md).

| Class | Method | Resource / Role | Check type | Source |
| --- | --- | --- | --- | --- |
| `SAIF.Services.Security.ClaimSecurityService` | `GetClaimSecurity` / `LoadClaimSecurity` | `ConflictClaim`, `SecureClaim` | `IsAuthorized` | `Core/SAIF.Core/Contracts/Security/IClaimSecurityService.cs` (contract); implementation in SAIF.Services |
| `SAIF.Services.Policies.SecurityServices.PolicySecurityService` | `IsValidPolicyForCurrentUser` / `ValidatePoliciesForCurrentUser<T>` / specified-user overloads | Per-user-type domain and AD resource checks | `IsAuthorized` composite | `Core/SAIF.Core/Contracts/Policies/Security/IPolicySecurityService.cs` (contract) |
| `SAIF.Services.Policies.Certificates.CertificateSecurityService` | `CertificateCanBeEdited/Deleted/Added/Renewed/Resent`, `CanCurrentUserAdd/AddOsc/Renew/RenewOsc/ViewOsc/Access` | SAIF.Services `SecurityResources` class | `IsAuthorized` | `Core/SAIF.Core/Contracts/Policies/Certificates/ICertificateSecurityService.cs` (contract) |
| `SAIF.Services.Groups.Imaging.GroupImageSecurityProvider` | `CanUserSeeConfidentialImages`, `CanUserSeeDeletedImages`, `CanUserEditImages` | Groups imaging `SecurityRoles` | `IsAuthorized` | `Core/SAIF.Core/Contracts/Groups/Imaging/IGroupImageSecurityProvider.cs` (contract) |
| `SAIF.Services.Agencies.Imaging.ImageService` | `CanUserSeeConfidentialImages`, `CanUserSeeDeletedImages`, `CanUserEditImages` | Agencies imaging `SecurityRoles` | `IsAuthorized` | `Core/SAIF.Core/Contracts/Agencies/Imaging/IAgencyImageService.cs` (contract) |

## Data-level authorization

This library declares, but does not implement, the following data-level authorization contracts. Enforcement logic is in `SAIF.Services`.

| Entity type | Validation method | Mechanism | Source |
| --- | --- | --- | --- |
| Policy (`IPolicyNumber`) | `IPolicySecurityService.IsValidPolicyForCurrentUser(long)`, `ValidatePoliciesForCurrentUser<T>(IEnumerable<T>)`, specified-user overloads | Ownership check: does the policy belong to (or is it serviced by) the current or specified user, composed from `IsExternal`, domain, and AD resource checks per user type* | `Core/SAIF.Core/Contracts/Policies/Security/IPolicySecurityService.cs` |
| Claim (`IClaimSecurityAttributes`) | `IClaimSecurityService.GetClaimSecurity` / `LoadClaimSecurity` | Composite: claim-level flags (`IsConflictClaim`, `IsSecureClaim`) combined with the user's conflict/secure AD access, returned as `ClaimSecurityAccess` | `Core/SAIF.Core/Contracts/Security/IClaimSecurityService.cs`, `Core/SAIF.Core/Contracts/Claims/Information/IClaimSecurityAttributes.cs` |
| Certificate (`CertificateSecurityProperties`, `OtherStatesPolicy`) | `ICertificateSecurityService.CertificateCanBeEdited/Deleted/Added/Renewed/Resent`, `CanCurrentUserAccess(OtherStatesPolicy)` | Per-entity permission contract combining certificate state with the user's maintain-own/maintain-others resources | `Core/SAIF.Core/Contracts/Policies/Certificates/ICertificateSecurityService.cs` |

## Segregation of duties

None found. No SOD classes or rules exist in this library. `EmployeePaymentAuthority.AuthorizedBy`/`AuthorizedByEmployeeId`, `PaymentAuthorityLimitHistory.AuthorizedBy`, and `CaseCost.AuthorizedByEmployeeId` carry approver identity, but no rule here compares approver and requester.

## Security interfaces and contracts

| Interface / Class | Role | Consumers | Source |
| --- | --- | --- | --- |
| `IClaimSecurityService` | Computes a user's conflict/secure claim access | `SAIF.Services.Security.ClaimSecurityService`; consumed by `Web/SAIF.Web.Mvc/Controllers/ClaimControllerBase.cs`, `Web/SAIF.Web.Mvc5/Controllers/ClaimControllerBase.cs`, `Web/SAIF.Web.Mvc/Controllers/LegalControllerBase.cs` | `Core/SAIF.Core/Contracts/Security/IClaimSecurityService.cs` |
| `IPolicySecurityService` | Policy ownership check for current/specified user | `SAIF.Services.Policies.SecurityServices.PolicySecurityService` | `Core/SAIF.Core/Contracts/Policies/Security/IPolicySecurityService.cs` |
| `ICertificateSecurityService` | Per-entity certificate authorization | `SAIF.Services.Policies.Certificates.CertificateSecurityService` | `Core/SAIF.Core/Contracts/Policies/Certificates/ICertificateSecurityService.cs` |
| `IGroupImageSecurityProvider` | Group-imaging authorization | `SAIF.Services.Groups.Imaging.GroupImageSecurityProvider` | `Core/SAIF.Core/Contracts/Groups/Imaging/IGroupImageSecurityProvider.cs` |
| `ILegalSecurityOverrideService` | Legal-case-keyed security override contract, same shape as `ISecurityOverrideService` | **No implementation found anywhere in the repository**; external implementer unknown** | `Core/SAIF.Core/Contracts/Legal/SecurityOverrides/ILegalSecurityOverrideService.cs` |
| `ClaimSecurityAccess` | Data carrier: `HasConflictAccess`, `HasSecureAccess` | Consumed by `IClaimSecurityService` implementations | `Core/SAIF.Core/Contracts/Security/ClaimSecurityAccess.cs` |

## Tech-debt and coverage findings

This section calls out the security tech-debt findings from the Stage 1c-security analysis that are specific to this library.

- **Only 6 of 16 AD resource-name constants have a compiled enforcement point in the repository** — the imaging Edit, Confidential, and Deleted roles for both Agencies and Groups. The other 10 have no enforcement anywhere in the compiled SAIF.Services build.
- **6 NotePad constants (Agency and Group Edit/Delete/Confidential) are referenced only by `NoteService.cs` files that are excluded from `SAIF.Services.csproj` — dead/unreachable code.** Any consumer implementing notes against these contracts outside this repository must re-implement the checks; otherwise note confidentiality and delete restrictions are unenforced**.
- **All 4 `ViewRole` constants (`AgencyImagingView`, `AgencyNotePadView`, `GroupImagingView`, `GroupNotePadView`) are never referenced anywhere in the repository.** View access to agency and group images and notes is therefore not gated by these resources anywhere in the repository; it is controlled by the host application or not at all**.
- **The `DeleteRole` constants carry an inconsistent meaning between imaging and notes.** For imaging (`AgencyImagingDeleted`, `GroupImagingDeleted`), the constant is used as "can see deleted images" (a view permission on soft-deleted records). For notes (`AgencyNotePadDelete`, `GroupNotePadDelete`), the constant is used as "can delete" (a destructive permission). The shared member name (`DeleteRole`) across four otherwise-parallel `SecurityRoles` classes hides this difference in meaning and invites misuse by a future consumer who assumes symmetric semantics.
- **`ILegalSecurityOverrideService` has no implementation anywhere in the repository.** It declares the same override CRUD shape as `ISecurityOverrideService` (which SAIF.Services does implement), but no `SAIF.Services` class, nor any other repository file, implements it. Any consumer relying on legal security overrides must supply an external implementer.
- The four `SecurityRoles` classes share the identical simple class name (`SecurityRoles`) across four different namespaces; the correct class is selected only by the consumer's `using` directive (verified correct in all compiled consumers, but a fragile pattern for future maintainers)*.
- Additional enforcement gaps in the *consumers* of these constants (documented for the SAIF.Services library) are out of scope for this page — see [`../saif-services/security-authorization.md`](../saif-services/security-authorization.md).

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with `**` could not be confirmed; treat as unknown until verified.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [API reference](api/index.md)

## Sources
- Core/SAIF.Core/SAIF.SAIFCode.Core.csproj
- Core/SAIF.Core/packages.config
- Core/SAIF.Core/app.config
- Core/SAIF.Core/Contracts/Agencies/Imaging/SecurityRoles.cs
- Core/SAIF.Core/Contracts/Agencies/Notes/SecurityRoles.cs
- Core/SAIF.Core/Contracts/Groups/Imaging/SecurityRoles.cs
- Core/SAIF.Core/Contracts/Groups/Notes/SecurityRoles.cs
- Core/SAIF.Core/Contracts/Security/ClaimSecurityAccess.cs
- Core/SAIF.Core/Contracts/Security/IClaimSecurityService.cs
- Core/SAIF.Core/Contracts/Policies/Security/IPolicySecurityService.cs
- Core/SAIF.Core/Contracts/Policies/Certificates/ICertificateSecurityService.cs
- Core/SAIF.Core/Contracts/Groups/Imaging/IGroupImageSecurityProvider.cs
- Core/SAIF.Core/Contracts/Groups/Imaging/IGroupImageService.cs
- Core/SAIF.Core/Contracts/Agencies/Imaging/IAgencyImageService.cs
- Core/SAIF.Core/Contracts/Claims/SecurityOverrides/ISecurityOverrideService.cs
- Core/SAIF.Core/Contracts/Legal/SecurityOverrides/ILegalSecurityOverrideService.cs
- Core/SAIF.Core/Contracts/Claims/Information/IClaimSecurityAttributes.cs
- Core/SAIF.Core/Contracts/Claims/Information/ClaimUserAccess.cs
- Core/SAIF.Core/Contracts/Claims/Information/ClaimForOnBase.cs
- Core/SAIF.Core/Contracts/OnlineMessages/IOnlineMessagesApiService.cs
- Core/SAIF.Core/Contracts/Policies/PolicyDocumentsApi/PolicyDocumentsReturnCodeList.cs
- Core/SAIF.Core/Contracts/Policies/PolicyDocumentsApi/ReturnCodeMessages.cs
- Core/SAIF.Core/Contracts/Claims/Authority/EmployeePaymentAuthority.cs
- Core/SAIF.Core/Contracts/Claims/Authority/PaymentAuthorityLimitHistory.cs
- Core/SAIF.Core/Contracts/Legal/CaseCost.cs
- Services/SAIF.Services/SAIF.Services.csproj
- Services/SAIF.Services/Agencies/Imaging/ImageService.cs
- Services/SAIF.Services/Agencies/Notes/NoteService.cs
- Services/SAIF.Services/Groups/Imaging/GroupImageSecurityProvider.cs
- Services/SAIF.Services/Groups/Imaging/ImageService.cs
- Services/SAIF.Services/Groups/Notes/NoteService.cs
- Services/SAIF.Services/Security/ClaimSecurityService.cs
- Services/SAIF.Services/Security/ClaimSecurityRoles.cs
- Services/SAIF.Services/Policies/SecurityServices/PolicySecurityService.cs
- Services/SAIF.Services/Policies/Certificates/CertificateSecurityService.cs
- Services/SAIF.Services/Claims/SecurityOverride/SecurityOverrideService.cs
- Services/SAIF.Services/OnlineMessages/OnlineMessagesApiService.cs
- Web/SAIF.Web.Mvc/Controllers/ClaimControllerBase.cs
- Web/SAIF.Web.Mvc5/Controllers/ClaimControllerBase.cs
- Web/SAIF.Web.Mvc/Controllers/LegalControllerBase.cs