What is an AuthorizationDeniedEvent, and how is it different from an authentication failure event?

AuthorizationDeniedEvent fires when an ALREADY-authenticated user is denied access to a specific resource or method they lack permission for (e.g., a failed @PreAuthorize check) — the identity check succeeded, but the permission check failed. This is a distinct and arguably more serious signal than an authentication failure event (Chapter 5), since it represents a known, logged-in identity attempting an action outside their granted permissions, which is a stronger indicator of insider threat or privilege escalation attempts.