What is the difference between @PreAuthorize and @PostAuthorize?

@PreAuthorize evaluates its SpEL expression BEFORE the method executes — if it fails, the method body never runs at all. @PostAuthorize lets the method run first and evaluates its expression AFTER, with access to the method's return value via returnObject — necessary when the authorization decision depends on data only available after execution, but at the cost of the method's side effects already having occurred even if access is ultimately denied.