I'm wondering about automatic fulfillment when it comes to IDM roles.

If I do a review and remove a number of IDM roles from users in AR I
want them to be removed in IDM without manual intervention.

According to the documentation that should be possible but it is not
clear to me if I must create a workflow in IDM for that?

The documentation section 19.3.2 tells me that I *can* create a custom
workflow but then in section 19.3.3 it tells me that I can assign
automated provisioning to any IDM application source without mention of
the workflow.

Basically, what do I need to do to auto fulfill the Remove Permission
Assignment task?