WebExpressionAuthorizationManager is a Spring Security AuthorizationManager implementation for evaluating web authorization decisions from Spring Expression Language (SpEL) expressions. It is commonly used through the authorizeHttpRequests().access() method when simpler authority checks are insufficient. section 7.1.1
Expression rules can combine authority checks, such as requiring read access while rejecting delete authority. Because these rules are less readable than hasAuthority() or hasAnyAuthority(), use them when the simpler methods cannot express the requirement. section 7.1.1
Expression-based endpoint restriction
Configure every request with c -> c.anyRequest().access("hasAuthority('WRITE')"). A user with WRITE receives the endpoint response; a user without it receives HTTP 403 Forbidden. section 7.1.1
