---
title: ClaimUserAccess
summary: API reference for ClaimUserAccess.
status: draft
owner: SAIF Claims BOF team
last_reviewed: 2026-08-21
library: SAIF.Application.Claim
reference_type: embedded
---

# ClaimUserAccess

`ClaimUserAccess` inherits `UserAccess` (local project reference, `SAIF.Application`) and exposes four named, claim-domain AD-resource checks (`SecureClaim`, `ConflictClaim`, `ExposureClaim`, `CollateralHealthClaim`) via the inherited `HasAccess` lookup. It is the per-user access token consumed by `ClaimSecurity` when evaluating per-claim access flags (see [Security and authorization](../../security-authorization.md)).

## Purpose
- Resolve the current user's AD-group membership for each of the four claim-domain security resources, encapsulating the base resource-name-to-`HasAccess`-call mapping.
- Supply the access token that `ClaimSecurity.CheckClaim` combines with claim characteristic flags to compute per-claim access decisions.

## Context
- Namespace: `SAIF.Application.Claim`
- Assembly/package: `SAIF.Application.Claim`

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `New(inSecurityPrincipal)` | `Public Sub New(inSecurityPrincipal As clsSecurityPrincipal)` | Constructs the access token for the given authenticated principal, evaluating all four AD-resource checks. |
| `New(inSecurityPrincipal, AccessRights)` | `Public Sub New(inSecurityPrincipal As clsSecurityPrincipal, ParamArray AccessRights() As <type>)` | Constructs the access token restricted to a specified subset of access rights*. |
| `SecureClaimAccess` | `Public ReadOnly Property SecureClaimAccess As Boolean` | Whether the user belongs to the `SecureClaim` AD resource group, gating hostile-worker claim access per [BR-CLM-004](../../business-rules.md#br-clm-004-hostile-secure-claim-access-restriction). |
| `ConflictAccess` | `Public ReadOnly Property ConflictAccess As Boolean` | Whether the user belongs to the `ConflictClaim` AD resource group, gating worker-conflict claim access per [BR-CLM-001](../../business-rules.md#br-clm-001-conflict-claim-access-restriction). |
| `ExposureAccess` | `Public ReadOnly Property ExposureAccess As Boolean` | Whether the user belongs to the `ExposureClaim` AD resource group, gating exposure and (indirectly) health-issue claim access per [BR-CLM-002](../../business-rules.md#br-clm-002-exposure-claim-access-restriction) and [BR-CLM-003](../../business-rules.md#br-clm-003-health-issue-claim-access-restriction). |
| `HealthIssueAccess` | `Public ReadOnly Property HealthIssueAccess As Boolean` | Whether the user belongs to the `CollateralHealthClaim` AD resource group. **Declared but never consulted**: `ClaimSecurity.CheckClaim` gates health-issue access using `ExposureAccess` instead, making this property effectively dead from this library's perspective — see [BR-CLM-003](../../business-rules.md#br-clm-003-health-issue-claim-access-restriction)*. |

## Inherited public members

Members in this section are inherited from `UserAccess` in `SAIF.Application` (local project reference; not a documented package framework — `SAIF.Application.Claim` has `frameworkDensity` = 0). `UserAccess.HasAccess`, the underlying AD-resource lookup used by every property above, is defined here but its internal WCF/AD implementation is out of this library's analysis scope and is not traceable from this library's source.

| Member | Signature | Purpose | Origin |
| --- | --- | --- | --- |
| `HasAccess(resourceName)` | `Public Function HasAccess(resourceName As String) As Boolean` | Resolves whether the current user belongs to the named AD resource group (base name; environment suffix applied internally); not traceable from this library's source** | `SAIF.Application` — `UserAccess` |

## Behavioral notes
- All four resource names are base names per the SAIF `<ResourceName>Resource`/`<ResourceName>TestResource` convention; the environment suffix is applied inside the inherited `HasAccess` implementation, not in this class's code*.

## Constraints and usage notes
- No `System.DirectoryServices`/WCF `SecurityService` client code is present directly in this class; any such plumbing is encapsulated inside the inherited `UserAccess.HasAccess`*.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Application.Claim\ClaimUserAccess.vb`