Skip to content

Evaluate claim access

This operation converts per-claim confidentiality flags into the coarse security role every claim manager relies on, applying the only hard-blocking rule this library enforces directly.

Field Value
Operation ID OP-CLM-2
Trigger Invoked only from ChangeContext()
Inputs ClaimData, SecurityPrincipal
Outputs ClaimSecurity flags, AppSecurityRole, denial Message
Primary components ClaimAppManager.OnCheckSecurity, ClaimAppManager.CheckForSecurityOverride, ClaimAppManager.ConfidentialAccessDeniedMessage
Entry point SAIF.Application.Claim/ClaimAppManager.vb

Steps

  1. ClaimSecurity.CheckClaim(ClaimData) lazily constructs ClaimSecurity(SecurityPrincipal) on first access, then recomputes the four access flags (BR-CLM-007, BR-CLM-008, BR-CLM-009, BR-CLM-010) — see Recompute per-claim access flags.
  2. MarkViewOnly() is called unconditionally; every claim context starts at view-only (BR-CLM-005).
  3. If Not ClaimSecurity.ConflictAccess and Not CheckForSecurityOverride(), call MarkNoAccess() and set Message = ConfidentialAccessDeniedMessage (BR-CLM-006).
  4. CheckForSecurityOverride() calls ClaimServices.HasOverrideAcess(DPI, ClaimData.ClaimID, SecurityPrincipal.UserName.ToString) — a per-claim, per-user override grant lookup.
    • Delegated logic: implemented in SAIF.BOF.Business.View.Claim; SQL and tables were not traced in this pass.**

      Origin: The security-override lookup is implemented in SAIF.BOF.Business.View.Claim (ClaimServices.HasOverrideAcess) and executed on behalf of this operation.

  5. ConfidentialAccessDeniedMessage composes "Please contact <AdjusterName> at <AdjusterPhone> for claim information." when the claim carries an adjuster first name, otherwise returns ClaimAppConstants.ERRORCONFIDENTIALCLAIM (BR-CLM-011).
  6. Only the conflict flag gates access here; exposure, hostile-worker, and health-issue flags are computed but not enforced by this library (BR-CLM-012).

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([OnCheckSecurity]) --> Check[ClaimSecurity.CheckClaim]
    Check --> ViewOnly[MarkViewOnly]
    ViewOnly --> ConflictTest{ConflictAccess?}
    ConflictTest -->|True| Allowed([View-only access granted])
    ConflictTest -->|False| Override{Security override granted?}
    Override -->|Yes| Allowed
    Override -->|No| Denied(["MarkNoAccess + denial<br>message"])

Failure and edge-case behavior

  • Exposure, hostile-worker, and health-issue denials are advisory only; a consuming manager that does not re-test them silently bypasses those controls.*
  • OnCheckSecurity dereferences ClaimData without a null guard; reachability of a null ClaimData here is unknown.**

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • SAIF.Application.Claim/ClaimAppManager.vb
  • SAIF.Application.Claim/ClaimAppConstants.vb