Ok, here's some more info on my problem:
I tested the lock with 2 thin clients accessing the same application server running jBPM and the lock didn't work. When I tested 2 thin clients accessing different applications servers, it worked, I couldn't load the process definition in server2 while server1 was still executing. But after server1 finished, server2 executed the process definition normally. I read somewhere in the forums that it should have rollback. What is correct?
And I still have the problem that if I use 1 AS with jBPM, any 2 clients can run the same process definition, even though it was locked. Is this really the correct behavior?