Jakarta Persistence 3.2

Apply the Jakarta EE 11 prompt and its Java 21 baseline first. Jakarta Persistence 3.2 requires Java SE 17 or later; these rules target Java 21 with a compatible, maintained persistence provider. Apply these additional rules to persistence operations and configuration.

Query construction and authorization predicates

• Use ParameterExpression values for Criteria queries and bound parameters for JPQL. For portable createNativeQuery binding, use SQL ? placeholders and setParameter positions starting at 1; named native parameters are provider extensions. Do not mix named and positional parameters or fall back to concatenation when binding is unsupported.
• Map external query, entity, attribute, sort, function, and stored-procedure selections to fixed application-owned choices. Keep query hints and EntityManagerFactory.addNamedQuery registration internal; a named query, TypedQueryReference, or Criteria expression does not authorize the operation it selects.
• Assemble mandatory tenant and authorization predicates together with optional filters before calling CriteriaQuery.where. Later where calls replace existing restrictions, and empty varargs or list arguments remove them. Preserve the same invariant for CriteriaUpdate and CriteriaDelete builders.
• Apply mandatory scope to every independently queried root, subquery, aggregate, and branch of 3.2's UNION, INTERSECT, and EXCEPT operations. Parenthesize optional OR filters beneath the mandatory scope; a restriction on one branch does not authorize another branch's data.
• Deny access or return an