Dynamic Group Lookup in JBPM -

i have been experimenting different ways of doing dynamic actor , group lookup. implementing custom usergroupcallback. authorization tricky since not conform standard jaas model. each user has role (assistant, administrator, officer); however, role specific department , functionality department. example, can assistant in hr department, have permission use time keeping functionality.

in initial experiment, created service task had inputs role, department, , functionality permissions. perform lookup determine users meet criteria , return comma separated string users. save string process variable , set actor list user task #{approvedusers}. approach works, dislike having predefined user list since role permissions change time task acted upon.

the next logical step generating dynamic comma separated list of group ids. since group needs single string, concatenated of possible attributes role. using previous example, user's role become 'assistant_hr_timekeeping'. able work, started go down path, noticed number of groups started out of hand. additionally there multiple users have multiple or 'all' department and/or functionality. main reason didn't want go down route need add more permissions in future, break of processes created prior switch over.

i have solution works, kludgey , not easy update future changes. there in jbpm allow easier dynamic authorization of actor/groups user tasks? preferably can implemented in java easier integrate our authentication/authorization system.