Spring Security (previously Acegi) gives you an awesome AOP way of locking down methods in your Java application. And well-placed lock down is a special power indeed. However, Spring disappoints a bit on this score because it turns out its default behavior is to ‘or’ the roles listed in @Secured annotation. You’d think the default would be the stricter ‘and’, but alas. But never fear, there is hope.