What do @Transactional, @Async, and @PreAuthorize have in common under the hood?

All three are built-in Spring AOP aspects sharing the exact same proxy-based interception mechanism — which is also why all three share the identical self-invocation limitation: calling any of them from within the same class bypasses the proxy entirely.