---
title: ClaimUserAccess
summary: API reference for ClaimUserAccess.
status: draft
owner: SAIF Documentation Generator
last_reviewed: 2026-08-21
library: SAIF.Application.Claim
reference_type: embedded
---

# ClaimUserAccess

`ClaimUserAccess` extends the framework `UserAccess` base class with the claim domain's four AD resource names (`SecureClaim`, `ConflictClaim`, `ExposureClaim`, `CollateralHealthClaim`). It is the sole owner of these resource-name literals in the codebase; `ClaimSecurity` consults it to translate AD group membership into per-claim access decisions.

## Purpose
- Declares and exposes the claim-domain AD resource vocabulary as boolean membership accessors, consumed by [ClaimSecurity](ClaimSecurity.md).
- Provides an extension seam (the `ParamArray` constructor) for bulk pre-resolution of caller-supplied resource names, though it is not exercised anywhere in this library or in `SAIF.Application.Claim.Legal`.

## Context
- Namespace: `SAIF.Application.Claim`
- Assembly/package: `SAIF.Application.Claim` (embedded, ProjectReference)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `New(inSecurityPrincipal)` | `Public Sub New(inSecurityPrincipal As clsSecurityPrincipal)` | Binds the principal via the inherited `SetPrincipal`. |
| `New(inSecurityPrincipal, AccessRights)` | `Public Sub New(inSecurityPrincipal As clsSecurityPrincipal, ParamArray AccessRights() As String)` | Binds the principal and pre-warms the inherited authorization cache for the listed resources; not called anywhere in this library. |
| `SecureClaimAccess` | `Public ReadOnly Property As Boolean` | AD membership verdict for the `SecureClaim` resource, backing `ClaimSecurity`'s hostile-worker check. |
| `ConflictAccess` | `Public ReadOnly Property As Boolean` | AD membership verdict for the `ConflictClaim` resource, backing `ClaimSecurity`'s worker-conflict check and the hard-blocking gate in `ClaimAppManager.OnCheckSecurity`. |
| `ExposureAccess` | `Public ReadOnly Property As Boolean` | AD membership verdict for the `ExposureClaim` resource, backing both the exposure and health-issue checks in `ClaimSecurity`. |
| `HealthIssueAccess` | `Public ReadOnly Property As Boolean` | AD membership verdict for the `CollateralHealthClaim` resource; publicly exposed but never consulted by `ClaimSecurity.CheckClaim` — a dead decision surface.** |

Resource keys are `Private Const` fields: `SECURECLAIMSECURITYKEY`, `CONFLICTSECURITYKEY`, `EXPOSURESECURITYKEY`, `HEALTHISSUESECURITYKEY`.

## Inherited public members

Members in this section are inherited from `UserAccess` in `SAIF.Application`. They are available on this type through inheritance.

| Member | Signature | Purpose | Origin |
| --- | --- | --- | --- |
| `HasAccess(resourceName)` | `Public Function As Boolean` | Returns a cached AD-membership decision for the resource name, calling `clsSecurityPrincipal.IsAuthorized` on cache miss and caching the result per lower-cased name.† | `SAIF.Application` — `UserAccess` |
| `SetPrincipal(principal)` | `Protected Sub` | Binds the security principal used by all `HasAccess` lookups.† | `SAIF.Application` — `UserAccess` |
| `CheckAccess(resourceNames)` | `Public Sub (ParamArray resourceNames() As String)` | Pre-resolves and caches AD membership for a batch of resource names.† | `SAIF.Application` — `UserAccess` |

## Behavioral notes
- The `CollateralHealthClaim` resource is declared and exposed but not consulted by any decision path in `ClaimSecurity`; whether this is intentional narrowing or a defect is unknown.**
- Resource names are base names only — the framework appends `Resource` (production) or `TestResource` (non-production) at runtime.*

## Constraints and usage notes
- The `ParamArray` constructor is an unused extension seam; consumers relying on it for bulk resolution should verify it is exercised as expected, since it has no call site in this repository.*

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified. Statements marked with
> † were retrieved from dependency library documentation via the Legends CLI RAG service. They
> describe inherited behavior from the indicated origin library and should be verified if the
> dependency version changes.

## Sources
- `SAIF.Application.Claim/ClaimUserAccess.vb`