Understanding RBAC and Authorization in Spring Security

Authentication established who you are. Authorization decides what that identity is allowed to do. Spring Security keeps them strictly sequential — a request has already answered the "who" question an