By default JBossESB server 4.3.GA has several jBPM users configured including 'user' and 'manager'.
bpm_orchestration4 example contains one process definition which assigns two tasks, first to actor-id 'user' and the second to actor-id 'manager'.
The problem is that the 'user' can see and manipulate both of the tasks.

Steps to reproduce:
1. download JBossESB server 4.3.GA
2. start it using bin/run.sh
3. go to samples/quickstarts/bpm_orchestration4
4. run one by one: ant deploy, ant deployProcess, ant startProcess
5. open jBPM console and login as 'user' with password 'user'
6. click on Tasks to see the task list and on Examine to open the task, then on Save and Close
7. refresh the task list and you can see second task assigned to 'manager', try to Examine it...