Indicates whether or not access is granted.
The decision must be affirmative (ACCESS_GRANTED
), negative (ACCESS_DENIED
) or the AccessDecisionVoter
can abstain (ACCESS_ABSTAIN
) from voting. Under no circumstances should implementing classes return any other value. If a weighting of results is desired, this should be handled in a custom {@link org.acegisecurity.AccessDecisionManager} instead.
Unless an AccessDecisionVoter
is specifically intended to vote on an access control decision due to a passed method invocation or configuration attribute parameter, it must return ACCESS_ABSTAIN
. This prevents the coordinating AccessDecisionManager
from counting votes from those AccessDecisionVoter
s without a legitimate interest in the access control decision.
Whilst the method invocation is passed as a parameter to maximise flexibility in making access control decisions, implementing classes must never modify the behaviour of the method invocation (such as calling MethodInvocation.proceed()
).
@param authentication the caller invoking the method
@param object the secured object
@param config the configuration attributes associated with the method being invoked
@return either {@link #ACCESS_GRANTED}, {@link #ACCESS_ABSTAIN} or {@link #ACCESS_DENIED}