Hi,
Security and business logic are not JPA issues.
As I see your environment is mixed: different applications (maybe
different vendors) accessing DB. Most probably you have to stick holding
business logic and security in DB.
It is architectural decision.
Anyway it does not deny your ability to use JPA for java applications.
Just invoke DB stored procedures and queries as you would do from other
applications (PHP, .NET). JPA will help you reduce a lot of code related
to JDBC.
Most probably current environment has some shortcomings (which I'm not
aware of) otherwise your company would not make decision to move to
j2ee.
As I understand it is not about JPA. It is about 2-tier or 3-tier.
I would suggest to ask decision makers - why?
If you make decision to change environment and move to 3-tier
architecture then you have to move business logic and security to
application server. DB becomes only storage. 3-tier allows you work with
different data storage (not necessary SQL-DB) in one application and not
all of them can implement (or hold) security model or business logic.