---
title: Application security and authorization
summary: Cross-cutting authorization architecture, AD resource catalog, security enforcement summary, and data-level access control across the application.
status: draft
owner: <owner>
last_reviewed: 2026-08-21
---

# Application security and authorization

This page documents the application-wide authorization architecture for Claims Legal, consolidating authorization patterns from all analyzed libraries and the front-end layer. Authentication is handled entirely by infrastructure (NTLM/AD) and is not application-level — all code receives a `WindowsIdentity`/`clsSecurityPrincipal` on the request context.

## Authentication architecture

Authentication is handled entirely by infrastructure and is not part of application code. All requests arrive with an identity established by IIS (internal users via NTLM/Kerberos); no MVC controllers, `[SAIFAuthorize]`/`[SaifAuthorize]` attributes, or `System.DirectoryServices`/`System.DirectoryServices.AccountManagement` usage were found in any of the five analyzed libraries. The application has no code for the authentication mechanism itself.

## Authorization architecture

Claims Legal's authorization is exclusively programmatic and layered: a generic, parameterized resource-name check (`UserAccess.HasAccess`, defined in [SAIF.Application](../libraries/saif-application/overview.md)) is the single mechanism through which every higher layer resolves "does this user hold AD resource X." [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md) and [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) build claim-level and case-level composite checks on top of that mechanism, combining AD resource membership with claim/case entity attributes (conflict, exposure, hostile-worker flags). [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md) layers a similar composite check for policy-level access, and [SAIF.Presentation.Web.Controls.PopUps.Infragistics111](../libraries/saif-presentation-web-controls-popups-infragistics111/overview.md) applies claim/image checks inside shared popup controls. No WCF `SecurityService` client code is visible in any of the five analyzed libraries; the underlying AD group membership resolution is delegated to the external `clsSecurityPrincipal` type (`SAIF.BOF.Framework.Security`), outside this repository's scope.*

```mermaid
flowchart TD
    User[User request] --> Identity[WindowsIdentity established by IIS/NTLM]
    Identity --> Principal[clsSecurityPrincipal injected into managers]
    Principal --> UA["UserAccess.HasAccess(resourceName)"]
    UA --> Cache{Cached?}
    Cache -->|Yes| Result[Cached access decision]
    Cache -->|No| Framework["clsSecurityPrincipal.IsAuthorized(resourceName)"]
    Framework --> AD[(Active Directory)]
    Framework --> Result
    Result --> Claim[ClaimSecurity.CheckClaim composite check]
    Claim --> Legal[LegalManagerBase.OnRetrieve composite gate]
    Result --> Policy[clsPolicySecurity.IsPolicyValidForUser]
    Result --> Popup[ImageMovePopup.CheckClaimSecurity / CheckImageSecurity]
```

## AD resource catalog

| Resource name | Purpose | Libraries using | Enforcement type |
| --- | --- | --- | --- |
| `SecureClaim` | Grants access to claims flagged as involving a hostile worker (`IsHostileWorker`). | [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md) | Programmatic |
| `ConflictClaim` | Grants access to claims flagged as a worker conflict (`IsWorkerConflict`); hard-gates `ClaimAppManager.OnCheckSecurity()`. | [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md) | Programmatic |
| `ExposureClaim` | Grants access to claims flagged as an exposure claim (`IsExposure`), and indirectly to health-issue claims that are also exposure claims. | [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md) | Programmatic |
| `CollateralHealthClaim` | Intended to grant access to health-issue claims; declared but never consulted by `ClaimSecurity.CheckClaim` (see [Tech debt](tech-debt.md)). | [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md) | Programmatic |
| `LNConflict` | Legal-case-level equivalent of `ConflictClaim`; grants `HasLegalConflictAccess`. | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | Programmatic |
| `LNExposure` | Legal-case-level equivalent of `ExposureClaim`; grants `HasLegalExposureAccess`. | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | Programmatic |
| `LNAdmin` | Full Legal-admin bypass: unconditional claim-view access and full note edit/delete rights. | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | Programmatic |
| `LNCaseUpdate` | Case-update role: broad note edit/delete rights and general case-update capability. | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | Programmatic |
| `LNView` | View-only role flag; consuming UI logic not observed within the analyzed application-tier library.** | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | Programmatic |
| `LNNoteView` | Grants case-note viewing capability. | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | Programmatic |
| `LNUpdate` | Grants bill-note (`DOCCO` category) update capability to non-admin/non-case-update users. | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | Programmatic |
| `LNLCEUpdate` | LCE (Legal Case Evaluation) update role. | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | Programmatic |
| `LNDueDateUpdate` | LCE due-date update role. | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | Programmatic |
| `SAIFpolicyInfo` | Gates access to "secure" SAIF-owned policies (`SecurePolicyCode = clsConstants.SAIF`); denies access to any user lacking this resource, regardless of user type. | [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md) | Programmatic |
| `ADSG_IMAGE` | Grants the current user access to their own imaged documents; cached and reused by `CheckImageSecurity`. | [SAIF.Presentation.Web.Controls.PopUps.Infragistics111](../libraries/saif-presentation-web-controls-popups-infragistics111/overview.md) | Programmatic |
| `ADSG_CLAIM_CONFLICT`, `ADSG_CLAIM_EXPOSURE`, `ADSG_CLAIM_COLLATERAL`, `ADSG_CLAIM_SECURE` | Popup-level equivalents of the claim conflict/exposure/collateral/secure flags, exercised via `CheckClaimSecurity`. | [SAIF.Presentation.Web.Controls.PopUps.Infragistics111](../libraries/saif-presentation-web-controls-popups-infragistics111/overview.md) | Programmatic |

<!-- 5 additional ADSG_IMAGE_* keys (ImagePolicy, ImageClaim, IDAAlertAdmin, IDAListAdmin, IDAQueueAdmin) and ADSG_IMAGE_SECURE are cached/declared in SAIF.Presentation.Web.Controls.PopUps.Infragistics111 but not observed being read/branched on beyond population** — omitted from the primary catalog above as dead/unused resource keys pending confirmation. -->

## Security enforcement summary

| Layer | Enforcement mechanism | Count | Libraries |
| --- | --- | --- | --- |
| Application (generic mechanism) | `UserAccess.HasAccess` / `UserAccess.CheckAccess` programmatic resource checks | 2 | [SAIF.Application](../libraries/saif-application/overview.md) |
| Application (claim-level) | Programmatic composite checks (`ClaimAppManager.OnCheckSecurity`, `ClaimSecurity.CheckClaim`, `CheckForSecurityOverride`) | 4 | [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md) |
| Application (case-level) | Programmatic composite checks (`LegalManagerBase.OnRetrieve`, `clsCaseNotesManager.CanUpdateAnyNote`/`CanUpdateBillNotes`, `clsScheduleManager` LCE flags) | 11 | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) |
| Business (policy-level) | Programmatic `clsPolicySecurity.IsPolicyValidForUser` secure-policy gate plus per-user-type checks | 1+ | [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md) |
| Presentation (popup-level) | Programmatic `CheckClaimSecurity` / `CheckImageSecurity` / `SetSecurityUserImage` | 3 | [SAIF.Presentation.Web.Controls.PopUps.Infragistics111](../libraries/saif-presentation-web-controls-popups-infragistics111/overview.md) |
| Infrastructure | None found — no SOD checks in any of the five analyzed libraries | 0 | — |

## Cross-cutting authorization rules

### SEC-APP-001 Confidential claim access requires resource membership or override

| Field | Value |
| --- | --- |
| **Statement** | Claims flagged as worker-conflict or exposure claims are hidden from users who lack the corresponding AD resource, unless an explicit security override succeeds. |
| **Trigger** | A claim with `IsWorkerConflict` or `IsExposure` set is loaded through `ClaimAppManager` or a legal case is opened through `LegalManagerBase`. |
| **Enforcement** | `ClaimAppManager.OnCheckSecurity()` calls `MarkNoAccess()` unless `ClaimSecurity.ConflictAccess` (from `ConflictClaim`) is true or `CheckForSecurityOverride()` succeeds; `LegalManagerBase.OnRetrieve()` applies an equivalent gate combining `LNConflict`/`LNExposure` with an `LNAdmin` bypass. |
| **Enforcing libraries** | [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md), [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) |
| **Outcome** | Access denied with a confidential-access error unless the resource is held or the override succeeds. |
| **Related resources** | `ConflictClaim`, `ExposureClaim`, `LNConflict`, `LNExposure`, `LNAdmin` |

---

### SEC-APP-002 Admin and case-update roles govern note edit delete rights

| Field | Value |
| --- | --- |
| **Statement** | Full note edit and delete rights require `LNAdmin` or `LNCaseUpdate`; non-privileged users may only edit bill (`DOCCO` category) notes via `LNUpdate`; notes created by `SYSTEM` cannot be deleted by any user. |
| **Trigger** | A user attempts to edit or delete a case note in `clsCaseNotesManager`. |
| **Enforcement** | `CanUpdateAnyNote = IsInAdminGroup OrElse IsInCaseUpdateGroup`; `CanUpdateBillNotes` gates bill-note-only edits; `DeleteNote()` unconditionally blocks deletion of `CreateUser = "SYSTEM"` notes. |
| **Enforcing libraries** | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) |
| **Outcome** | Deletion/edit attempts outside the allowed role/category combination are rejected. |
| **Related resources** | `LNAdmin`, `LNCaseUpdate`, `LNUpdate`, `LNNoteView` |

---

### SEC-APP-003 Secure SAIF-owned policies require the SAIFpolicyInfo resource

| Field | Value |
| --- | --- |
| **Statement** | Any user, regardless of user type, is denied access to a policy flagged as "secure" (`SecurePolicyCode = clsConstants.SAIF`) unless they hold the `SAIFpolicyInfo` AD resource. |
| **Trigger** | A screen requests policy or policyholder data through `clsPolicySecurity.IsPolicyValidForUser`. |
| **Enforcement** | `clsPolicySecurity.IsPolicyValidForUser` runs a data-level, policy-scoped `SAIFpolicyInfo` override check before applying the per-user-type ownership/scope rule. |
| **Enforcing libraries** | [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md) |
| **Outcome** | Access denied for secure policies without the resource, independent of any other user-type-based access grant. |
| **Related resources** | `SAIFpolicyInfo` |

---

### SEC-APP-004 Demo-user data masking

| Field | Value |
| --- | --- |
| **Statement** | Demo users see masked policyholder data instead of live values across 5+ fields in `clsPolicyData`. |
| **Trigger** | A policy-context screen (e.g., [frmSummary](../screens/frm-summary.md), [frmRequest](../screens/frm-request.md)) loads policyholder data for a user flagged `IsDemoUser`. |
| **Enforcement** | `clsPolicyData` conditionally masks policyholder fields when `IsDemoUser` is true. |
| **Enforcing libraries** | [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md) |
| **Outcome** | Demo users never see live policyholder details, protecting production policyholder data in demo/training contexts. |
| **Related resources** | — |

---

### SEC-APP-005 System-mailbox image-move allow-list bypasses resource checks

| Field | Value |
| --- | --- |
| **Statement** | `ImageMovePopup.CheckImageSecurity` grants access unconditionally for six hard-coded system mailbox IDs without an AD resource check. |
| **Trigger** | An image-move action targets one of the six enumerated system mail IDs. |
| **Enforcement** | A `Select Case inMailId.ToUpper` branch returns `True` for the enumerated system mailbox constants before any `ADSG_IMAGE`/AD-resource check runs. |
| **Enforcing libraries** | [SAIF.Presentation.Web.Controls.PopUps.Infragistics111](../libraries/saif-presentation-web-controls-popups-infragistics111/overview.md) |
| **Outcome** | System-mailbox image moves bypass the standard `ADSG_IMAGE` authorization check entirely; see [Tech debt](tech-debt.md) for the associated remediation recommendation. |
| **Related resources** | `ADSG_IMAGE` |

## Data-level authorization

| Entity type | Validation pattern | Enforcement library | Source |
| --- | --- | --- | --- |
| Claim | Composite check combining claim characteristic flags (`IsWorkerConflict`, `IsExposure`, `IsHealthIssue`, `IsHostileWorker`) with AD-resource membership (`ConflictClaim`, `ExposureClaim`, `SecureClaim`) | [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md) | `SAIF.Application.Claim/ClaimSecurity.vb` |
| Legal case | Composite check combining `ClaimData.IsWorkerConflict`/`IsExposure` with `LNConflict`/`LNExposure` and an `LNAdmin` bypass | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | `SAIF.Application.Claim.Legal/LegalManagerBase.vb` |
| Case note | Category/ownership gating — deletion allowed only for `CanUpdateAnyNote` holders or bill (`DOCCO`) notes; `SYSTEM`-created notes are never deletable | [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md) | `SAIF.Application.Claim.Legal/LegalNet/clsCaseNotesManager.vb` |
| Policy | Secure-policy AD-resource override combined with a per-user-type ownership/scope rule | [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md) | `SAIF.Business.View.Policy/clsPolicySecurity.vb` |

## Segregation of duties

No segregation-of-duties (SOD) classes, methods, or conflicting-privilege checks were found in any of the five analyzed libraries ([SAIF.Application](../libraries/saif-application/overview.md), [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md), [SAIF.Application.Claim.Legal](../libraries/saif-application-claim-legal/overview.md), [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md), [SAIF.Presentation.Web.Controls.PopUps.Infragistics111](../libraries/saif-presentation-web-controls-popups-infragistics111/overview.md)).

## Security dependencies

| Dependency | Type | Purpose |
| --- | --- | --- |
| `clsSecurityPrincipal` (`SAIF.BOF.Framework.Security`) | External framework package | Central AD-resource authorization check (`IsAuthorized`), consumed by `UserAccess.HasAccess` across all layers* |
| Active Directory | Infrastructure | User/group identity store underlying every `<ResourceName>` check |
| IIS / NTLM / Kerberos | Infrastructure | Establishes the `WindowsIdentity`/`clsSecurityPrincipal` for every request |

## Notes
- Mark inferred statements with `*` and unknown statements with `**`. Do not use bold inline confidence labels.
- AD resource names use base names only — the framework appends `Resource` (production) or `TestResource` (non-production) at runtime.*
- `ClaimServices.HasOverrideAcess`, the sole override mechanism for `SEC-APP-001`, could not be traced to its owning library; see [Tech debt](tech-debt.md).

## Related documentation
- [Application index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Data model](data-model.md)
- [Tech debt](tech-debt.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with `**` could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Application/UserAccess.vb`
- `SAIF.Application/AppManagerBase.vb`
- `SAIF.Application.Claim/ClaimAppManager.vb`
- `SAIF.Application.Claim/ClaimSecurity.vb`
- `SAIF.Application.Claim/ClaimUserAccess.vb`
- `SAIF.Application.Claim.Legal/LegalManagerBase.vb`
- `SAIF.Application.Claim.Legal/LegalNet/clsCaseNotesManager.vb`
- `SAIF.Application.Claim.Legal/LegalNet/clsScheduleManager.vb`
- `SAIF.Business.View.Policy/clsPolicySecurity.vb`
- `SAIF.Presentation.Web.Controls.PopUps.Infragistics111/ImageMovePopup.vb`