Bulk actions on approval tasks

Bulk actions on approval tasks are used for making easy and asynchronous changes on multiple identities.

Delegate

• Add approvers
• Remove approvers

Adds the selected users as approvers of the selected approval tasks.

• A selected user who is already an approver of a task is silently skipped — the existing approver record is kept untouched (no duplicate is created). The action is idempotent:
  running it twice with the same selection has the same effect as running it once.
  * In replace mode (checkbox on), new approvers are created first and only then are the unselected current approvers removed, so a task is never left without an approver at any
  point. Current approvers who are part of the selection keep their original approver record.
  * The whole selection is processed all-or-nothing per task: all required permissions are checked before any change is made. If any single create/delete would not be permitted, the
  task fails as a whole and no partial change happens.
  * No notification is sent to the added approvers and no delegation is created — the users are added directly. Configured delegations of the added users are not resolved (unlike the
  reassignment and delegation flows).

This action is governed by the permission group APPROVALTASKAPPROVER (Approval task
approvers, entity IdmApprovalTaskApprover) and its permission CREATE. If the user wants to also use the "Remove old approvers" option, they will need the DELETE permission as well.

Removes the selected users from the approvers of the selected approval tasks.

• Selected users who are not approvers of a particular task are simply ignored for that task — the action still finishes successfully (even when none of the selected users is an

approver; the task is then left unchanged).

• When the removal takes away the last active approver of a task, the task is automatically reassigned by the same mechanism used when an approver is deleted or disabled: new

approvers are resolved by the configured reassign script (idm.pub.core.wf.approval.task.reassign.script), with fallback to default approvers. A running task is therefore never left
without an approver.

• Permissions are checked for all matching approver records before any change — if the user may not delete any one of them, the task fails as a whole and nothing is removed

(all-or-nothing per task).

• No history record (FORMER_APPROVER identity link) is created — direct removal is distinct from delegation.

This action is governed by the permission group APPROVALTASKAPPROVER (Approval task
approvers, entity IdmApprovalTaskApprover) and its permission CREATE