The AbstractSecurityInterceptor will ensure the proper startup configuration of the security interceptor. It will also implement the proper handling of secure object invocations, being:

1. Obtain the Authentication object from the SecurityContextHolder .
2. Determine if the request relates to a secured or public invocation by looking up the secure object request against the ObjectDefinitionSource .
3. For an invocation that is secured (there is a ConfigAttributeDefinition for the secure object invocation):
   1. If either the isAuthenticated() returns false, or the alwaysReauthenticate is true, authenticate the request against the configured AuthenticationManager . When authenticated, replace the Authentication object on the SecurityContextHolder with the returned value.
   2. Authorize the request against the configured AccessDecisionManager .
   3. Perform any run-as replacement via the configured RunAsManager .
   4. Pass control back to the concrete subclass, which will actually proceed with executing the object. A InterceptorStatusToken is returned so that after the subclass has finished proceeding with execution of the object, its finally clause can ensure the AbstractSecurityInterceptor is re-called and tidies up correctly.
   5. The concrete subclass will re-call the AbstractSecurityInterceptor via the afterInvocation(InterceptorStatusToken, Object) method.
   6. If the RunAsManager replaced the Authentication object, return the SecurityContextHolder to the object that existed after the call to AuthenticationManager.
   7. If an AfterInvocationManager is defined, invoke the invocation manager and allow it to replace the object due to be returned to the caller.
4. For an invocation that is public (there is no ConfigAttributeDefinition for the secure object invocation):
   1. As described above, the concrete subclass will be returned an InterceptorStatusToken which is subsequently re-presented to the AbstractSecurityInterceptor after the secure object has been executed. The AbstractSecurityInterceptor will take no further action when its afterInvocation(InterceptorStatusToken, Object) is called.
5. Control again returns to the concrete subclass, along with the Object that should be returned to the caller. The subclass will then return that result or exception to the original caller.