Controlling access to business process data is disclosed. An instance of a first business process object configured to contain business process data of a business process is created. An instance of a second business process object configured to contain business process data of the business process is created. A first access control list is associated with the instance of the first business process object and a second access control list is associated with the instance of the second business process object.