<accessCertificationDefinition xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                               xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                               xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
                               xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3"
                               xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
                               xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
                               xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3"
                               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                               oid="982ff2aa-38e9-4ab9-a129-5ee56a2ea3f6" version="8">
    <name>Review critical risk level assignments</name>
    <description>Certifies all users' assignments which have critical risk level</description>
    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/certification/handlers-3#direct-assignment</handlerUri>
    <scopeDefinition xsi:type="c:AccessCertificationAssignmentReviewScopeType">
        <objectType>UserType</objectType>
        <itemSelectionExpression>
            <script>
                <code>
                    role = midpoint.resolveReferenceIfExists(assignment.targetRef)
                    return role != null &amp;&amp; role.riskLevel == 'critical'
                </code>
            </script>
        </itemSelectionExpression>
        <searchFilter>
            <q:text>name != "administrator"</q:text>
        </searchFilter>
        <includeAssignments>true</includeAssignments>
        <includeInducements>true</includeInducements>
        <includeRoles>true</includeRoles>
        <includeOrgs>true</includeOrgs>
        <includeServices>true</includeServices>
        <includeUsers>true</includeUsers>
        <enabledItemsOnly>true</enabledItemsOnly>
    </scopeDefinition>
    <ownerRef oid="00000000-0000-0000-0000-000000000002" relation="org:default" type="c:UserType"/>
    <remediationDefinition>
        <style>automated</style>
    </remediationDefinition>
    <stageDefinition id="8">
        <number>1</number>
        <name>Administrator's review</name>
        <description>In this stage, the administrator has to review all the assignments of all users.</description>
        <duration>P3D</duration>
        <notifyOnlyWhenNoDecision>false</notifyOnlyWhenNoDecision>
        <reviewerSpecification>
            <useTargetOwner>false</useTargetOwner>
            <useTargetApprover>false</useTargetApprover>
            <useObjectOwner>false</useObjectOwner>
            <useObjectApprover>false</useObjectApprover>
            <defaultReviewerRef oid="00000000-0000-0000-0000-000000000002" relation="org:default" type="c:UserType"/>
        </reviewerSpecification>
    </stageDefinition>
    <reviewStrategy>
        <outcomeStrategy>oneDenyDenies</outcomeStrategy>
    </reviewStrategy>
</accessCertificationDefinition>
