Case candidate users or groups

I have a BPMN Process that instantiate a CMMN case. The behavior I would like to achieve is that some users can instantiate the case and I know that I can control this with the attributes startableCandidateUsers or statableCandidateGroups in the case definition or in my specific case I can control who can instantiate a case within my BPMN user task. But the user who instantiates the case may not have access to the case instance, so is there something like candidate users or groups that can be defined at case instance level?
Or this is something that I have to control inside my human tasks?

Thanks,
Bruno Alves

I found that that to involve an user or a group in a case instance we need to add an identity link between the case instance and the group and/or user.

CaseInstance caseInstance = startCaseInstance(caseDefinition.getId());

cmmnRuntimeService.addUserIdentityLink(caseInstance.getId(), USER_ID, "candidate" );

// Query involved users
List<CaseInstance> userInvolvedCaseInstances =
cmmnRuntimeService.createCaseInstanceQuery()
.involvedUser(USER_ID)
.list();