If nothing is specified, the form manager should display all actions to all users, CLAIM, REVOKE should be available to any user out of the box.
It is however possible to have certain actions only for certain users or roles. To do this, you have to set the roles and users in the related task metadata.
Each Task has an action/acl list that should be filled with the list of roles and users that can access the action
In, Task.java
, this is represented by:
Map<String, ACL> _actionACLs = new HashMap<String, ACL>();
This is field can be updated at different time in the task lifecycle.
At design time, a graphical representation, taken from Intalio|Designer, for doing such a change to the CLAIM action, would be:

The result would be that the actions would only be available to the users and roles that have been added.