ie. You have a human task and this taks is assigned to some user. You can view all taks in all prcesses, you can view tasks of only your tasks, you can view tasks in your group etc... AFAIK you only set users/groups and call methods in your services to get tasks/processes depanding or user/group or all. Its up to you to restrict acces in your services. you call a method to show all tasks of user "krisv" and its up to you in your services to allo certain users to be able to see results etc.