Thanks very much for Esteban's clear answer.
I was thinking user task for several days, the task permission can be used by actionId, groupId and Swimlane in jBPM, but our system's permission is quite difficult. Now I deciede to design a work flow engineer, actual it is a state machine. The basic theroy is work flow difinition and manager work flow instance state. The blow is my workflow definition prototype. You maybe see my main idea.
<workflow id="101" action="issue.do" url="issue.jsp">
<start name="open issue" id=1001>
<to target=1002 command="start progress" commandClass="start.do" url="inprogress.jsp"/>
<to target=1003 command="close issue" commandClass="closeIssue.do" url="done.jsp"/>
</start>
<state name="in progress" id=1002 >
<to target=1003 command="close issue" commandClass="closeIssue.do" url="done.jsp"/>
</state>
<end name="close" id=1003>
</end>
</workflow>