Method-level security authorizes bean-method invocations using the caller’s security context, preventing unauthorized users from reaching protected application capabilities or tools. section 10.2
Enable and apply it in Spring Security:
- Add @EnableMethodSecurity to the security configuration. section 10.2
- Annotate protected methods with @PreAuthorize and a SpEL expression. section 10.2
- Use hasRole('PREMIUM_USER') to permit only callers holding the PREMIUM_USER role. section 10.2
- Expect an AccessDeniedException when the expression evaluates to false. section 10.2
Protecting an LLM tool
Annotate a getGameComplexity tool or Function.apply() method with @PreAuthorize("hasRole('PREMIUM_USER')"). Premium users receive the game complexity; other users receive an authorization response instead. section 10.2
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
// ...
}
The configuration listing shows the single annotation needed to enable method-level security. section 10.2
