How do you test Spring Security authentication and authorization rules?

I maintain a permission matrix by route or capability and generate focused cases without hiding failures in one giant parameterized test. Method security is invoked through the Spring proxy so the advice actually runs, and alternate adapters are tested where they can call the same service. A small full-flow test uses real credential verification or a representative identity provider boundary to catch wiring gaps. Audit events and denial metrics are asserted for sensitive operations without exposing personal data.