Migrate from Red Hat PAM to Apache KIE: what the move involves
Apache KIE 10 is the open-source lineage of jBPM and Drools, so a Red Hat PAM 7 estate that is past end of life can move there mostly by re-testing and re-packaging its assets rather than rewriting them. The platform or architecture team usually owns the work, often with an implementation partner for the runtime changes and the test effort. Start by inventorying every BPMN process, DMN model, rule package and work item handler, then decide which of them change at all. Models that run on the jBPM engine and rules that depend only on Drools are the lowest-risk candidates to test first. Work item handlers, custom Business Central extensions and anything that calls KIE Server APIs are where most of the change will sit.
The biggest structural change is the runtime. KIE Server and Business Central are not the target shape for most new deployments, and the Kogito-based runtime on Quarkus or Spring Boot replaces the packaged server model. Your team will need to decide how each process service is built, deployed, versioned and monitored in your own Kubernetes or VM estate. Confirm with the Apache KIE project which parts of the old tooling still apply, because the 10.2.0 release removed the classic BPMN and DMN editors and replaced the legacy GWT-based tooling with a new BPMN editor. Plan for authoring changes as well as runtime changes, since business analysts will work in a different editor.
Apache KIE is still in incubation at the Apache Software Foundation. The project's site states that incubation does not necessarily reflect the completeness or stability of the code, only that the ASF has not yet fully endorsed the project. That means your organization carries the support, patching and upgrade burden, through its own staff or a contracted partner, and should price that into the decision. Ask any partner to document how they will track upstream security fixes, which release line they will support, and how they will handle in-flight process instances during each upgrade. Run a pilot with production-like volumes and a rollback plan before committing a critical process to the new runtime.
Which Red Hat PAM capabilities map to Apache KIE, and which need rework
This table maps each Red Hat PAM 7 capability to its Apache KIE 10 equivalent and marks it clean, needs rework or gap. Read it as a first-pass inventory: clean rows still need a test run on your own assets, and rework rows usually decide the migration effort. Confirm every row against your exact PAM version, extensions and custom code before committing to a schedule.
| Capability | Apache KIE 10 equivalent | Status and what to check |
|---|---|---|
| jBPM BPMN processes | jBPM engine in Apache KIE, with the new BPMN editor from 10.2.0 | Needs rework: re-validate every model on the 10.x engine; the classic BPMN editor was removed in 10.2.0 |
| Drools rules (DRL and decision tables) | Drools in Apache KIE 10 | Clean for most rules: run your rule test suite; confirm any custom KIE extensions or non-standard functions |
| DMN decision models | DMN runtime in Apache KIE; DMN 1.6 supported from 10.2.0 | Needs rework: the classic DMN editor was removed in 10.2.0, so models must be edited elsewhere or re-saved; confirm DMN 1.x version compatibility |
| Business Central authoring | Business Central successor tooling under Apache KIE; new BPMN editor replaces legacy GWT tooling | Gap: confirm which authoring screens you use and whether a replacement exists for each; plan for authors to change tools |
| KIE Server deployment | Kogito-based runtime on Quarkus or Spring Boot, packaged as your own service | Needs rework: the deployment model changes from a shared server to an application you build and operate |
| Work item handlers | Custom service tasks or handlers in the Kogito-based runtime | Needs rework: each handler must be re-implemented and tested against the new runtime API |
| Process management APIs | REST and Java APIs in the Kogito-based runtime | Gap: endpoints and payloads can differ; inventory every client call and confirm each one against the new API |
| Java runtime and frameworks | Java 17 and Jakarta 10 from 10.0.0; Java 21, Quarkus 3.27.2 and Spring Boot 3.5.10 from 10.2.0 | Confirm: check your JDK, application server and library versions before upgrading |
| Running process instances | Apache KIE 10 runtime with your persistence layer | Gap: in-flight instances need a drain or migration plan; confirm with the project's documentation for your version |
Moving from KIE Server and Business Central to a Kogito-based runtime on Quarkus or Spring Boot
The core change is in the deployment model. Red Hat PAM teams usually ran a shared KIE Server that loaded deployable units from Business Central, and the process and rule assets were pushed to it at runtime. In the Apache KIE line, the runtime is a service you build: processes, decisions and rules are compiled into a Kogito-based application that runs on Quarkus or Spring Boot and ships as its own artifact. Apache KIE 10.0.0 set Java 17 and Jakarta 10 as the baseline, so any application code, dependencies and base images must already support both before you start. Confirm the supported Quarkus and Spring Boot versions for each release you plan to adopt, because the KIE release posts name specific framework versions (10.2.0 moved to Quarkus 3.27.2 and Spring Boot 3.5.10) and those change between lines.
Build pipelines and packaging change most. Instead of uploading a KJAR to a central server, the pipeline compiles BPMN, DMN and rule resources with the application, runs the test suite, and produces a container image per service. Image builds, dependency scanning and promotion to each environment move into your CI system, which means the platform team owns the Maven repository, the base image and the runtime configuration keys. Two repository facts matter here. The Kogito Runtimes and Kogito Apps repositories are archived on GitHub, and their code now lives in apache/incubator-kie-drools, so pin your dependencies and documentation links to that location. The BPMN editor also changed in 10.2.0, so confirm which authoring tool your business analysts will use before you change the pipeline.
Responsibilities split between developers and operations. Developers own process models, decision tables, rule logic and the unit and integration tests that exercise them. Operations owns the container platform, scaling, health checks, secrets for data sources, and the decision of when a new image replaces a running one. Business Central no longer deploys to the runtime, so business-side changes must go through a Git commit and a pipeline run, and you should agree on who approves those merges. Plan for in-flight instances during each rollout, since a new image does not automatically carry the state of processes started on the old one. Ask the vendor for a written statement on upgrade and state-migration support for your target version before you commit to this model.
What data, process state and integrations you need to move
A PAM move touches four kinds of material: the definitions and rules you deploy, the process instances still running, the Java code that connects processes to other systems, and the audit trail. Each needs its own export path, owner and test, and none should be assumed to move just because the process model does.
Deployed process definitions and rule packages
Inventory every BPMN process, DMN decision model and Drools rule package deployed from Business Central or KIE Server, including the versions and the container or KJAR coordinates they are built from. Note which assets are authored in the classic editors, because Apache KIE 10.2.0 removed the classic BPMN and DMN editors and replaced the BPMN editor, so those models will need to be opened and re-saved in the new tooling. Confirm the export and import options for your exact PAM 7 version with Red Hat documentation, then run a test deployment before you count the model as migrated.
In-flight process instances and their store
Running instances hold state in the database that KIE Server or Business Central uses for persistence. Identify which instances are still active, which are waiting on timers, signals or human tasks, and which persistence store and schema they live in. The documented path is to let existing instances finish on PAM where possible, or to plan a drain window. Do not assume an automated instance migrator exists for your version. Confirm with Red Hat and prove any instance-level move in a test environment with a copy of production data.
Custom work item handlers and service integrations
jBPM work item handlers, custom task implementations and KIE Server REST clients are Java code that calls your own systems. Each one must be mapped to its equivalent on the Kogito-based runtime, typically a Quarkus or Spring Boot service with generated process code, and its credentials, endpoints and error handling must be reviewed. List every handler by name, the systems it calls and the owner who signs off. Treat this inventory as the input to your code change estimate, since it is usually the largest unknown in the move.
Audit and history data
Process audit logs, task history and any data your regulators or internal auditors rely on must be kept outside the runtime that you retire. Decide whether history stays in the legacy database as a read-only archive, is exported to a reporting store, or is replaced by new logging on the Apache KIE runtime. Confirm which audit tables your PAM version writes, how long your retention policy requires them, and whether the chosen export preserves timestamps and actor identities. Validate that the archive is readable before decommissioning anything.
Credentials, users and roles
Business Central and KIE Server rely on their own user, role and group configuration, which often maps to LDAP, Keycloak or an application realm. The new runtime will authenticate through whatever your Quarkus or Spring Boot services use, so task assignment, process admin rights and API access need to be re-mapped deliberately. List every role that appears in process definitions or task assignments and confirm the mapping with the team that owns the identity provider before cutover.
The migration sequence from inventory to decommission
The sequence moves Red Hat PAM 7 workloads to Apache KIE in five gated stages, so each asset is proven on the new runtime before traffic or in-flight work moves. Every stage closes with a written artifact that the next stage depends on.
Build the asset and dependency inventory
Start by listing every BPMN process, DMN decision table, Drools rule package, work item handler, custom Java class, form and external integration that runs on PAM 7. Record which Business Central spaces and KIE Server containers host each asset, which systems call them, and how many process instances are active. Assign each item a migration owner and a test owner. The output is an asset register that also shows the database, JVM, identity and monitoring dependencies behind each container. The step is done when the business owners have signed off that the register is complete.
Pilot one representative process and one rule package
Choose one BPMN process with human tasks, timers and service calls, and one Drools rule package with a DMN decision table that the process depends on. Rebuild them on the Apache KIE 10 line, replacing work item handlers with the equivalent service integrations, and run them on the target runtime, Quarkus or Spring Boot. Compare outputs with production results for the same inputs and log every difference. The output is a test evidence pack covering inputs, expected and actual outputs, and the changes made to the assets. Confirm the exact KIE 10 release and the editor behavior against the current release notes before you start, since the BPMN editor changed in 10.2.0.
Run both platforms in parallel
Send the same test inputs, and where policy allows a copy of live inputs, to both PAM 7 and the Apache KIE runtime. Compare decisions, task routing, timer behavior, error handling and data written to downstream systems. Treat each mismatch as a defect to fix or a documented, approved change in behavior. Include failure cases such as partial outages and malformed messages, not only the happy path. The output is a reconciliation report listing every asset, the number of comparisons, the open differences and the owner of each. The step is done when open differences are closed or formally accepted.
Cut over in controlled waves with an instance drain
Move new process starts to Apache KIE one asset group at a time, and let PAM 7 finish the instances it already holds. Track in-flight instances per asset until the count reaches zero or until the remaining cases are migrated by a tested, scripted method approved by the process owners. Keep PAM 7 running and able to accept traffic during the window so you can reverse direction. The output is a cutover log per wave and a rollback plan that names the trigger conditions, the person who decides, and the steps to reroute traffic. Verify that monitoring and alerts cover both runtimes during the drain.
Decommission Business Central and KIE Server
After the drain completes and no instances or audit queries depend on PAM 7, stop the Business Central and KIE Server components in that order. Archive the final database snapshots, asset repositories, configuration files and audit logs under the retention rules your compliance team requires, and confirm with your auditors which records they will need to see. Revoke service accounts, firewall rules and certificates tied to the old platform. The output is a decommission record that lists each removed component, where its archive is stored, and who approved the removal. Ask Red Hat or your support contract holder which final data and license obligations apply before you retire the subscription.
Running both platforms in parallel and cutting over
This pattern routes new process starts to Apache KIE while instances already running on PAM finish on the old platform. It fits processes with short lifespans, processes whose state you can safely restart, and new business flows with no existing instances. Both platforms stay live until the last PAM instance completes, so the old environment remains the fallback.
- Routing point: Decide where starts are switched, such as an API gateway, a calling service's configuration, or a feature flag, and confirm each caller can target either platform.
- Instance ownership: Record which platform owns each instance so support staff know where to look for a given case.
- Parity testing: Replay representative start payloads against both engines and compare outcomes, including DMN decision results and human task assignments.
- Rollback: Revert the routing point so new starts return to PAM. Instances already on Apache KIE continue there, so rollback covers only new work.
- Retirement: Keep PAM read-only for audit and history queries until your retention rules allow removal.
Before switching, confirm with your environment owners how long your slowest process runs and whether the Apache KIE runtime you deploy matches your tested version.
This pattern stops new starts on PAM, lets in-flight instances complete there, and migrates only what cannot finish in time. It fits long-running processes, such as those with timers or waits for external events, where a restart would repeat work or send duplicate messages. Drain time depends on your longest process path, which you must measure yourself rather than assume.
- Drain window: Measure the longest realistic instance duration from PAM history, including timer and wait states, and agree the window with process owners.
- Instances that cannot drain: Identify instances that will outlive the window and decide, per process, whether to migrate their state or to close and restart them under written business approval.
- Message and timer checks: Confirm that correlation keys, signals and timers are handled exactly once during the switch.
- Rollback: Until the drain completes, PAM remains authoritative for in-flight work, so you can reopen new starts there. Once instances move, rolling back requires reversing those moves.
- Evidence: Export completed-instance history and keep it with your change records for the audit trail.
Before switching, confirm with your process owners which instances are business-critical and whether your state migration method has been tested on a copy of production data.
This pattern sends the same decision inputs to both the PAM rule service and the Apache KIE DMN service, uses the PAM result for production, and records the Apache KIE result for comparison. It fits rule-heavy decisioning such as eligibility, pricing or risk scoring, where a silent change in output carries material risk. Shadow results never change customer outcomes until you decide to switch.
- Comparison scope: Define which fields must match exactly and which differences are expected, such as timestamps or versioned rule identifiers.
- Input capture: Store anonymized or tokenized inputs according to your data protection rules, and confirm the shadow store sits inside your own boundary.
- Mismatch review: Set a process for reviewing every difference, with named owners who can classify it as a defect or an accepted change.
- Switch criteria: Agree written criteria for promoting Apache KIE to primary, and keep PAM serving until they are met.
- Rollback: Flip the primary flag back to PAM. Because PAM stays deployed during shadowing, this rollback is immediate.
Before switching, confirm the Apache KIE rule and DMN assets were converted and tested against your own decision samples, not only the vendor examples.
What drives migration cost and duration
This table lists the factors that move the effort of a Red Hat PAM 7 to Apache KIE 10 migration, why each one matters, and how to keep it under control. Use it to scope your own estate before asking for a quote, since most of the cost sits in custom code, test coverage and the skills your team has available.
| Driver | Why it moves effort | How to keep it down |
|---|---|---|
| Number of processes and rule packages | Every BPMN model, DMN decision and DRL package must be opened in the new tooling, re-validated and re-tested, so effort scales with the inventory. | Inventory assets first, retire unused processes, and group rule packages by owning team to batch the review. |
| Custom Java in work item handlers | Handlers written against PAM work item interfaces must be rewritten as service tasks or Java delegates for the Kogito-based runtime, which is the largest source of code change. | Count handlers early, isolate business logic from framework calls, and keep handlers small so the rewrite is mechanical. |
| Long-running and in-flight instances | Instances started on the old runtime must either finish there, be migrated, or be drained, and each choice needs cutover planning and sign-off. | Ask for a count of active instances by process, set a drain window, and decide per process whether migration tooling is needed. |
| Number of integrations | REST, messaging and database connectors are rebuilt or re-tested against the new Quarkus or Spring Boot runtime, and each external contract adds test and coordination work. | List every system a process calls or is called by, and reuse existing API contracts and test doubles. |
| Test coverage | Without automated tests on current behavior, teams must prove equivalence by hand, which often costs more than the code changes themselves. | Capture expected outputs from production-like inputs before changing anything, and automate those checks in CI. |
| Business Central authoring by business users | If analysts edit processes and rules in Business Central, the new authoring path (including the BPMN editor introduced in 10.2.0) needs training and a decision on who owns models after migration. | Decide the authoring toolchain early, run a short pilot with business owners, and document the approval workflow for changes. |
| Internal skills in Quarkus or Spring Boot | Teams that already run Java services on these frameworks move faster, while teams without them need training or outside help to operate the new runtime. | Confirm the framework choice against existing platform standards, and ask any partner to name the engineers who will do the work. |
What usually goes wrong and how to prevent it
Most failed moves from Red Hat PAM to Apache KIE come from planning assumptions, not from the engine itself. The six risks below cover support, tooling, runtime state, decision behavior, custom code and recovery, and each one has a prevention step you can put in the migration plan before work starts.
Treating an incubating project as a vendor product
Apache KIE is still in incubation at the Apache Software Foundation, and the project notes that incubation does not necessarily reflect how complete or stable the code is. Red Hat PAM came with a commercial support contract, so teams often assume the same safety net exists. Before cutover, name who fixes a production defect in Drools, jBPM or the Kogito-based runtime, under what terms, and how quickly. Write that support plan down and get it signed off by the service owner.
Underestimating editor changes after 10.2.0
Apache KIE 10.2.0 replaced the legacy GWT-based tooling with a new BPMN editor and removed the classic BPMN and DMN editors. Analysts who learned Business Central on PAM will find their working habits no longer match the tooling. Inventory every role that edits models, then test whether each person can open, change and save an existing BPMN and DMN asset in the new editor. Budget time for retraining and for rewriting any internal style guides that reference old screens.
Assuming in-flight instances move with definitions
Deploying a new process definition does not move running process instances onto it. Instances started on the PAM runtime keep their old model and variables, and their state may not map cleanly to the new engine. Classify running instances by process, age and business criticality, and decide per class whether to let them finish on PAM, migrate them, or cancel and restart them. Test the chosen path on a copy of production data before you commit to it.
Dropping DMN behavior differences
DMN decision tables and FEEL expressions can return different results when the engine version, hit policy handling or type coercion changes. Apache KIE 10.2.0 added DMN 1.6 support, so a model that loads cleanly may still evaluate differently than it did under PAM. Build a regression set from production decisions, including boundary values, nulls and empty lists, and run the same inputs through both engines. Sign off only on matching outputs, and record every intentional difference.
Missing custom handler dependencies
Work item handlers, custom Java classes and Drools rule functions often sit in PAM-specific modules or depend on libraries that the new runtime does not bring along. These dependencies rarely appear in the BPMN file, so a model can deploy and then fail at the first call to a missing handler. Scan every project for custom handlers, global variables and imported packages, then map each to a replacement service task, REST call or Quarkus or Spring Boot bean. Confirm that the Quarkus or Spring Boot build packages each one and test every path in the integration suite.
Skipping a rollback path
A cutover without a tested return path leaves the team stuck if a defect appears after running instances have moved or new orders have started on the new runtime. Keep the PAM environment, its database and its deployed KIE Server artifacts intact until the cutover window closes. Document the exact trigger for rollback, the owner who decides it, and the steps to route new process starts back to PAM. Rehearse that rollback in a non-production environment before the production date is fixed.
How the migration differs by starting point
A small estate has a handful of BPMN processes, few or no custom work item handlers, and limited rule usage. The migration scope is mostly about re-validating models and rebuilding the deployment pipeline on Apache KIE's current runtime, not about rewriting logic. Because the asset count is low, a single engineer or a small team can usually inventory every process and decide on each one individually. The main risk is assuming a small estate is a simple one: a single process that calls an unlisted handler or depends on a Business Central form can still block a cutover.
- Inventory: list every BPMN, DMN and rule asset, and every work item handler, with its owner and last execution date.
- Editor change: the BPMN editor in Apache KIE 10.2.0 replaces the legacy GWT-based tooling, so confirm that models edited in Business Central still open and save cleanly.
- Runtime choice: decide between Quarkus and Spring Boot early, since it affects packaging and the deployment pipeline.
- Retire the old stack: plan a single cutover date with the old KIE Server still available for rollback.
- Test coverage: run each process path with representative input data and compare outputs with production records.
Before cutover, ask your team to confirm that every asset in the inventory has a passing test and a named owner.
A rule-heavy estate depends on Drools rules and DMN decision models that many processes call. Here the risk sits less in the process flow and more in rule behavior, because a rule that fires in a different order or a DMN table that evaluates differently can change decisions without any visible error. Apache KIE 10.2.0 adds DMN 1.6 support, which may affect how existing models are read, so the migration should include a regression suite that compares decision outputs across the old and new engines. Rules and decisions also tend to be owned by a different group than processes, which adds coordination work.
- Decision regression: build input sets that cover edge cases, then compare outputs from the old and new engines for each decision table.
- DMN version check: confirm how existing DMN models behave under DMN 1.6 support before changing their definitions.
- Rule ordering: review salience, agenda groups and rule flow groups, because they must produce identical outcomes after the move.
- Ownership: agree in writing which team signs off on decision changes, since rule owners are often outside the process team.
- Separate deployment: consider versioning rule packages independently from process packages so each can roll back on its own.
Before cutover, ask for evidence that the decision outputs match on the full regression set, not only on the sample cases.
A large estate has many processes, long-running instances that may wait days or months on human tasks or timers, and Business Central used daily by business analysts and administrators. The migration scope expands to cover in-flight instance state, persistence, user roles and the way Business Central content is exported and reviewed. The central risk is instances that started on the old runtime and must complete there or be migrated safely, which is an operational decision as much as a technical one. Business Central usage also means workflows, permissions and team habits must be documented and rebuilt, not assumed to carry over.
- In-flight instances: classify running instances by version and state, and decide which will drain on the old runtime and which will be migrated.
- Persistence: confirm the database schema and backup plan for both runtimes during the overlap period.
- Business Central dependence: list every role, space and user workflow that depends on the old interface, and assess each for the new BPMN editor.
- Capacity testing: load test the new runtime with realistic concurrency before moving production traffic.
- Operational runbook: document restart, scaling and incident steps for the Quarkus or Spring Boot deployment.
Before cutover, ask your team to confirm the count of in-flight instances per process and the agreed handling for each group.
Questions teams ask before migrating from Red Hat PAM to Apache KIE
What does a migration from Red Hat PAM to Apache KIE cost?
The cost is mostly people time, and it splits into one-time work and recurring work. One-time costs cover assessing your jBPM processes, Drools rules and DMN models, rewriting work item handlers, changing the runtime to Quarkus or Spring Boot, building CI/CD and testing, and cutover. Recurring costs cover running the platform, patching, upgrades and any support you buy. Apache KIE itself is Apache License 2.0 software, so there is no license fee to pay, but you pay for the engineers who do the work, for infrastructure, and for whatever support model you choose. The main cost drivers are how many processes and rules you run, how much custom Java sits inside them, and how many environments you operate. Ask any implementation partner for a fixed-scope quote built from an inventory of your assets, not from a per-seat estimate.
How long does a Red Hat PAM to Apache KIE migration take?
No supplied source gives a duration, so treat any timeline as something to build from your own inventory. The main drivers are the number of BPMN processes, DMN decision models and Drools rule packages, how many of them depend on custom work item handlers or Business Central assets, how many in-flight process instances must finish or be migrated, and how many environments need to be rebuilt. A team with a small, well-documented estate will finish far sooner than one with years of undocumented rules. Start with a discovery phase that counts assets and dependencies, then plan a parallel run in a non-production environment. Ask for the timeline in a written scope with named deliverables.
What does the migration need from our internal team?
Your team needs people who know the business process and the rules, people who can read and change Java, and people who run your container and CI/CD platform. Business analysts must confirm that each BPMN model and decision table still produces the outcomes the business expects. Developers must move custom work item handlers to the new runtime and update tests. Platform engineers must build the Quarkus or Spring Boot images, deployment manifests, observability and backup routines that replace KIE Server and Business Central. Someone must own the decision on what happens to in-flight process instances. Plan for a named technical owner who can sign off each phase, since most delays come from unclear ownership rather than from code.
Can our own team migrate from Red Hat PAM to Apache KIE without a partner?
Yes, a capable team can do it, but the question is whether your team has the spare capacity and the skills in the gaps. The work is open and documented, and Apache KIE has a public release history, so there is no license barrier. The risks are skills and continuity: you need people who know jBPM, Drools and the Kogito runtime, and you need them to stay on the project through cutover and beyond. A useful test is whether two or three engineers can each explain the full path from a BPMN model to a running service in your environment. If not, a fixed-scope engagement that includes knowledge transfer and runbooks can cover the gap. Either way, document decisions as you go.
How do we run production on an incubating Apache project?
Apache KIE is still in incubation at the Apache Software Foundation. The KIE site states that incubation does not necessarily reflect the completeness or stability of the code, only that the ASF has not yet fully endorsed the project. In practice, this means you own more of the risk: there is no vendor commitment to patch timelines or support SLAs unless you buy them elsewhere. Mitigate this by pinning versions, reading each release post, running your own regression suite for every BPMN, DMN and rule asset, keeping a tested upgrade path, and monitoring the project's issue tracker and mailing lists. Decide early who will triage security advisories and approve upgrades. Confirm with any support provider exactly which versions and components they will cover.
Which BPMN, DMN and rule assets move cleanly to Apache KIE?
Assets that use standard BPMN 2.0 and DMN models with few vendor extensions usually move with the least work, because the modeling standard is shared. Apache KIE 10.2.0 added DMN 1.6 support and Java 21 support, and it replaced the classic BPMN and DMN editors with a new BPMN editor, so you should test models in the new editor before relying on them. Drools rules that are plain Java-compatible rule files and DRL usually need the least change, but any rules that depend on older Drools behavior, custom functions or Business Central-only artifacts need individual testing. Assets with custom work item handlers, Java-heavy scripts, or dependencies on KIE Server APIs need the most attention. Test the highest-value and most-used assets first.
What does cutover look like, and what happens to running process instances?
A safe cutover runs old and new platforms side by side for a defined period, with traffic moved in stages and a rollback path kept until the new platform proves stable. Decide first what happens to in-flight process instances: you can let them finish on the old runtime, or you can migrate their state, which needs a tested, scripted approach and a rehearsal in a non-production environment. Confirm that audit logs, task histories and any monitoring used for regulatory evidence are preserved or archived in a readable form. Define go and no-go criteria in writing, rehearse the switch at least once, and keep the old environment in read-only mode for an agreed retention window.
How should we handle security and audit evidence during the move?
Treat the new runtime as a new system for security purposes. Rebuild images from pinned versions, scan dependencies, restrict access to the process and rule management interfaces that Business Central used to provide, and set up authentication and role mapping for task users. Keep audit trails for process changes, rule changes and deployments, because regulators and internal auditors will ask how each decision was made. Document controls so an assessor can trace them, and ask your compliance team which evidence they will need. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors and certification bodies issue the audit reports and attestations.
How DeployOpen scopes, runs and supports the migration
DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, and that includes moving Red Hat PAM 7 processes and rules to Apache KIE. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
How we scope
- We inventory your jBPM BPMN models, Drools rules, DMN decision tables and work item handlers before agreeing on a scope.
- The written scope lists which assets move, which are retired, and which run in parallel during cutover.
- We confirm with you which in-flight process instances must finish on PAM 7 and which can be migrated or drained.
- Scope also records your target runtime, Quarkus or Spring Boot, and the Java version your platform team supports.
How we build
- We rebuild the runtime on Apache KIE 10 and re-validate each BPMN and DMN asset against the new engine and editor.
- Work item handlers are replaced with equivalent service integrations, and each replacement is tested against its original behavior.
- We set up the build, container images, configuration and secrets handling in your own cloud accounts or data centers.
- Security testing of the migrated APIs and process endpoints runs before any production traffic moves across.
How we hand over
- Deliverables include the migration inventory, test evidence, architecture notes and runbooks for deploying and rolling back.
- Your team receives documentation for the Kogito-based runtime, including how KIE Server and Business Central functions map to it.
- We document the incubating status of Apache KIE and the upgrade path your team should expect to follow.
- Knowledge transfer sessions cover operating the platform, with your staff confirming they can run it independently.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- A retainer can cover tracking new Apache KIE releases, such as the 10.x line, and testing them before you adopt them.
- Ask in the quote what response arrangements apply, since these depend on the agreed scope and retainer terms.
- We prepare control evidence for your compliance assessments, while independent auditors issue any formal opinion.

