code: public int checkContactSecurity(String strContactType, String strContactID)
      {
          int iErrorCode = DBConstants.NORMAL_RETURN;
          
          if (Utility.isNumeric(strContactType))
          {
              ContactTypeModel recContactType = (ContactTypeModel)Record.makeRecordFromClassName(ContactTypeModel.THICK_CLASS, this);
              strContactType = recContactType.getContactTypeFromID(strContactType);
              recContactType.free();
          }
  
          String strUserContactType = this.getProperty(TrxMessageHeader.CONTACT_TYPE);
          String strUserContactID = this.getProperty(TrxMessageHeader.CONTACT_ID);
          
          if ((strUserContactType == null) || (strUserContactType.length() == 0) || (strUserContactType.equalsIgnoreCase(strContactType)))
              iErrorCode = DBConstants.NORMAL_RETURN; // No contact or different contact, okay
          else if ((strUserContactID != null) && (strUserContactID.equalsIgnoreCase(strContactID)))
              iErrorCode = DBConstants.NORMAL_RETURN; // Matching contact, okay
          else
              iErrorCode = DBConstants.ACCESS_DENIED; // Non-matching contact, NO
          
          return iErrorCode;
      }
docs: Special security check for screens that only allow access to users that are contacts (such as vendors, profiles, employees).
  If this contact type and ID match the user contact and ID, allow access, otherwise deny access.
  NOTE: Special case if this user is not a contact or is a different type of contact (such as an administrator), allow access.
  @param strContactType
  @param strContactID
  @return