The access decision mechanism for method security—whether or not a given request is allowed—is conceptually the same as the access decision logic for web request access. AccessDecisionManager polls a set of AccessDecisionVoters, each of which can provide a decision to grant or deny access, or abstain from voting. The specific implementation of AccessDecisionManager aggregates the voter decisions and arrives at an overall decision to allow for the method invocation.
Web request access decision making is less complicated, due to the fact that the availability of servlet filters makes interception (and summary rejection) of securable requests relatively straightforward. As method invocation can happen from anywhere, ...
