If a user is granted to UPDATE a task, the user is able to

• reassign the task to another user
• add/delete from the candidate group(s)/user(s)
• change the task's due date
• complete/submit the task
• claim the task
• etc.

AT:

• there exists separate permissions
  • one permission "TASK_WORK" to claim and complete/submit the task
  • one permission "TASK_ASSIGN", which summarize the following actions: reassign the task, add/delete candidate groups/users, etc.
  • the permissions can be set on task and process definition level
  • the permission UPDATE includes both these other permissions.

Note:

• the implementation should be backward compatible