Named query visibility scope and accidental public access in kdeneon

This question addresses the diagnosis of named query visibility scope within kdeneon's access‑control framework to prevent accidental public exposure. The supported feature is the Hibernate‑style named query definition, which enables static SQL reuse across sessions, and its interaction with kdeneon's permission model requires careful configuration.

Key constraints include version‑specific persistence of @NamedQuery mappings, where older releases may require explicit XML mapping, and the :name parameter binding syntax that prevents SQL injection but whose access‑control implications are not fully documented for kdeneon. Additionally, restricting query visibility to specific packages or XML mapping scopes may conflict with kdeneon's default public‑access defaults.

What access‑control mechanisms does kdeneon provide for named query visibility? How does the :name parameter binding syntax integrate with kdeneon's permission evaluation? Are there version‑dependent limitations on restricting query scope to internal packages?