JBPM itself is not a web page to be able to use security. It your application within you use jbpm that should handle security. The process and rules repository is called guvnor and its separate application with security but its for managing resources and not for your application normal user, only for ppl like admins or management. JBPM-console is sample implementation of application which uses jbpm5.2 engine for running processes and it has its own security, but its just sample application to get you started or test/show capabilities of jbpm engine.