anchor.diff:            flowable:candidateGroups="managingDirector" flowable:formKey="createApproval"> // <1>
     <extensionElements>
       <flowable:formProperty id="username" name="Username" type="string"
  -                           expression="${user.username}" writable="false"/> // <2>
  +                           expression="${userTO.username}" writable="false"/> // <2>
       <flowable:formProperty id="approve" name="Approve?" type="boolean"
                              variable="approve" required="true"/> // <3>
       <flowable:formProperty id="rejectReason" name="Reason for rejecting" type="string"
  
positive.code: . administrator A claims the approval and is then allowed to manage it
  . administrator A reviews the updated user, with ongoing modification applied (no actual modification performed yet)
  . administrator A can approve or reject such modification
  
negative.code: The following conditions must be met, for an User `U` to act as administrator for approval:
  
  . `U` must own the following <<entitlements,entitlements>>, for all the required realms:
  .. `USER_REQUEST_FORM_CLAIM`
  .. `USER_REQUEST_FORM_LIST`
  .. `USER_REQUEST_FORM_SUBMIT`
  .. `USER_READ`
  . The BPMN `userTask` must either indicate `U` among `candidateUsers` or at least one of the groups assigned to `U`
  among `candidateGroups`, as required by
  