I'm trying to get FIM CM workflows to work like this:
AD Group: Managers, every action should be executed by this group
AD Group: Subscribers, no self service, no execute rights on anything...
Can someone tell me how to configure this? When trying to Retire card, it's only doable (the execution part) by the subscribers and I don't want that... I know there are several places where to set the rights but could someone tell me how to configure this?