Given the following project: https://github.com/DuncanDoyle/jbpm-four-eyes-process

This process aims to implement a very simple "four-eyes-principle" process. It contains 2 human-tasks. The idea is that the actor that completed the first task is not allowed to work on the second task. This is implemented by having an output mapping on the first task that maps the "ActorId" on a process variable and an input mapping on the second task that maps that process variable onto the "ExcludedOwnerId".

I've debugged the PeopleAssignmentHelper, and the ExcludedOwner is correctly set on the PeopleAssignment of the task. I can see in the task MVELLifeCylceManager that when the claim command of the second task comes in, the PeopleAssignment indeed has the ExcludedOwner set to the actor that completed the first task. However, the same user is still able to claim, start and complete the task.

It seems that the MVELLifeCycleManager.isAllowed(....) method does not take ExcludedOwners into account when it checks whether the user is allowed to execute a command/operation on the task.

Second, the task also shows up the user's task-list in Business Central.

IMO, a user that is in the ExcludedOwner list of a task should not be able to see these tasks, operate on these tasks, etc.