# Can I use candidateGroups to restrict user access to a task?

**URL:** <https://forum.flowable.org/t/can-i-use-candidategroups-to-restrict-user-access-to-a-task/1818>\
**Category:** Flowable Engine\
**Created:** [April 2, 2018, 3:34pm UTC](https://forum.flowable.org/t/can-i-use-candidategroups-to-restrict-user-access-to-a-task/1818 "2018-04-02T15:34:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jli](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@jli](https://forum.flowable.org/u/jli)\
**Post date:** [April 2, 2018, 3:34pm UTC](https://forum.flowable.org/t/can-i-use-candidategroups-to-restrict-user-access-to-a-task/1818/1 "2018-04-02T15:34:24Z")

</div>

Hi, I’m just starting to use Flowable and working my way through the tutorials.

In the “Getting Started” example, a user task is created with candidateGroups set to “managers”.

`<userTask id="approveTask" name="Approve or reject request" flowable:candidateGroups="managers"/>`

However, when I create a new user which is not assigned to any group, I can still use that identity to perform the task of “approveTask” and set the “approved” variable to true.

I was expecting to get some kind of error message when I try to perform the “approveTask” with an identity which is not authorized for the “managers” group. Am I missing something? Or is there another property to control user access to a task?

---

<div class="post-metadata">

**Author:** ![khcung](https://avatars.discourse-cdn.com/v4/letter/k/b19c9b/32.png) [@khcung](https://forum.flowable.org/u/khcung)\
**Post date:** [November 26, 2019, 2:38pm UTC](https://forum.flowable.org/t/can-i-use-candidategroups-to-restrict-user-access-to-a-task/1818/2 "2019-11-26T14:38:24Z")

</div>

@jli Have you found a solution to this issue? I am facing the same scenario and would like to see how you’ve handled yours. Thanks

---

<div class="post-metadata">

**Author:** ![tjmac](https://avatars.discourse-cdn.com/v4/letter/t/bc8723/32.png) [@tjmac](https://forum.flowable.org/u/tjmac)\
**Post date:** [November 27, 2019, 1:27pm UTC](https://forum.flowable.org/t/can-i-use-candidategroups-to-restrict-user-access-to-a-task/1818/3 "2019-11-27T13:27:40Z")

</div>

In your code, check if the authenticated user is the assignee.