Why does `@PreAuthorize` on a method sometimes get silently ignored?

Method security only applies through Spring's proxy mechanism, so a `@PreAuthorize`-annotated method called from another method in the SAME class bypasses the proxy entirely (it's a plain Java method call, not going through the bean), and the check never fires. The call has to come from a different bean — through the proxy — for the annotation to take effect.