1. A method for controlling access to business process data, comprising: specifying a first business process object to hold business process data of a first business process, associating the first business process object with a first access control list for controlling access of first business process object by the first business process, instantiating an instance of the first business process, including creating using a processor an instance of the first business process object configured to contain business process data that is to be manipulated by the instance of the first business process; associating with the first instance of the business process object an access control list that is determined based at least in part on the business process accessing the first business process object, including associating the first instance of the first business process object with the first access control list; specifying the first business process object to hold business process data of a second business process, associating the first business object with a second access control list for controlling access of the first business process object by the second business process, instantiating an instance of the second business process, including creating using a processor an instance of the first business process object configured to contain business process data that is to be manipulated by the instance of the second business process; and associating with the second instance of the first business object with an access control list that is determined based at least in part on the business process accessing the first business process object, including associating the second instance of the first business process object with the second access control list; wherein the first business process and the second business process is each defined by an unique set of steps for manipulating data stored in one or more business process objects; wherein the access control list indicates a type of access that an application and users will be allowed to have to the business process object.