Sep 20, 2026 · Backend Development

Why RBAC Isn't Enough: Building an ABAC Policy Engine with Spring Security

The article explains why RBAC fails for complex resource and context permissions, introduces ABAC with SpEL expressions, shows Spring Security integration via PermissionEvaluator, policy storage using SpEL strings, a deny-first policy engine, real-world scenarios (department orders, document visibility, time-based access), list permissions via SQL filtering, hot reload with Caffeine/Redis, and pitfalls like self-invocation and DB calls in policies.

ABACAttribute-Based Access ControlData Permissions

0 likes · 17 min read

Why RBAC Isn't Enough: Building an ABAC Policy Engine with Spring Security

Spring Full-Stack Practical Cases

Jul 7, 2024 · Backend Development

Master Spring Security Method-Level Authorization with @PreAuthorize

This tutorial walks through enabling Spring Security method-level protection in a Spring Boot 2.7.16 project, covering @EnableGlobalMethodSecurity, role and authority checks, custom PermissionEvaluator, parameter access, custom annotations, and bean‑based permission rules with practical code examples.

PermissionEvaluatorSpring Securitymethod-security

0 likes · 8 min read

Master Spring Security Method-Level Authorization with @PreAuthorize