one-time-examples/order-confirmation-rules/src/main/java/org/camunda/bpm/demo/orderconfirmation/bean/AbstractEntityList.java
protected CriteriaQuery<T> createQuery(CriteriaBuilder cb) {
    CriteriaQuery<T> query = cb.createQuery(getEntityType());
    // building the base query: "select e from EntityType e"
    Root<T> e = query.from(getEntityType());
    query.select(e);

    // adding sort restrictions
    if(sortColumn != null) {
      Path<Object> sortField = e.get(sortColumn);
      if (sortAsc) {
        query.orderBy(cb.asc(sortField));
      } else {
        query.orderBy(cb.desc(sortField));
      }
    }
    return query;
  }
protected CriteriaQuery<T> createQuery(CriteriaBuilder cb) {
    CriteriaQuery<T> query = cb.createQuery(getEntityType());
    // building the base query: "select e from EntityType e"
    Root<T> e = query.from(getEntityType());
    query.select(e);

    // adding sort restrictions
    if(sortColumn != null) {
      Path<Object> sortField = e.get(sortColumn);
      if (sortAsc) {
        query.orderBy(cb.asc(sortField));
      } else {
        query.orderBy(cb.desc(sortField));
      }
    }
    return query;
  }
this can be subclassed to add custom restrictions to the query / replace the query