As I look at this more closely, I expected the `DAO` to be responsible for returning the persistence-bound managed object rather than having the Service new it up.  Here the Service implementation is newing up a will-be-JPA-managed object.

So, shouldn't this be more like:

    final ITenant tenant = tenantDao.create(name, fname, attributesMap);