===== Automatic contract guarantee reassignment transfer =====

<note warning> The feature is **NOT RELEASED** and documentation is a **DRAFT** </note>

Certain identities are required to always have guarantors on each of their contracts. This feature ensures that this is maintained. When the **last active guarantor** of a contract is **deactivated **or **deleted**, a new guarantor (or several guarantors) resolved by a configurable script is assigned to the contract. The deactivated guarantor is then removed as a guarantor of that contract, i.e. it **WILL NOT **automatically be a guarantor of that contract again if reactivated.

<note warning> This feature only works in the time of the event of the guarantor's deactivation or deletion. It will not reassign guarantors to contracts if their past guarantors were deactivated before the feature was deployed. To assign guarantors to those contracts, a schedulable task is provided. </note>

<note tip> The reassignment runs asynchronously - the result is only visible when once the event is processed. When deactivating a user with many subordinates, this may take some time </note>

==== Which contracts does this apply to ====

There is a configuration item ''idm.sec.core.contract-guarantee.externistFormProjections'' that contains a comma-separated list of form projection codes that determine which identities need their contracts to be guaranteed by someone. The feature then guards all contracts that belong to those identities.
==== How does the feature check managers ====

The feature uses the configured managersFor filter set in the configuration item ''idm.sec.core.filter.IdmIdentity.managersFor.impl''. The most common values are guaranteeManagersFilter (managers are direct guarantees only) and defaultManagersFilter (both direct guarantees and guarantees over tree structure are managers)
==== When does the reassignment happen ====

=== Direct guarantor removal ===

Direct guarantor removal and reassignment is triggered when the guarantor identity is deleted or deactivated, either manually or due to contract expiration/deactivation/deletion. It does **NOT **happen when the IdmContractGuarantee object itself is deleted or changed - that can only happen during manual removal of the guarantor done deliberately by an administrator.

<note> During contract synchronization from a system, it can happen that all of an identity's contracts are deactivated but the identity itself stays active until the [[https://wiki.czechidm.com/devel/documentation/hr_processes|HR processes]] run </note>