Scenario 12: A @PreAuthorize check on a service method is being completely ignored when called from another method in the SAME class.

This is self-invocation: Spring's method security relies on an AOP proxy wrapping the bean, but a call from within the same class instance (this.method()) goes directly to the real object, bypassing the proxy entirely. Fix by moving the annotated method into a separate bean and calling it via injection, or by using AopContext.currentProxy() (requires exposeProxy=true) as a less clean alternative.