In terms of staying agnostic from Oracle Suite 11g, BPMN2.0 is already a standard. If we want to stay abstracted from business process reliance on the BPM Workspace, though, we should be using our own human task construct. There's another standard to use around this, and we should be using this to map onto our next BPM vendor. There's also WS-ORG and WS-Identity. It looks like JBPM uses WS-ORG natively, which would give us a nice migration later on. There can be a fallacious failure to wire together components, especially a deprecated business rule, which will be erroneously represented as being from composite.xml. It is in fact inside the SOA part of your BPM Navigator, inside your process.composite. A full text search across your project should find it. The BPM API silently fails to produce an authenticationService if you are not an admin user - it's null. Scratch that, it looks like it just fails to produce an authenticationService full stop. It's looking increasingly like we should be going with web services, which are a little laborious, but at least they're decipherable. This proprietary, undocumented API layer with no community around it is a little bit terrifying.