What's the actual difference between a Role and an Authority under the hood?

Both are ultimately represented as GrantedAuthority instances — there is no separate Java type for 'role' versus 'authority'. The only distinction is a naming CONVENTION: roles are, by convention, prefixed with ROLE_ and checked via hasRole()/hasAnyRole() (which automatically add/expect that prefix), while authorities have no fixed prefix and represent finer-grained permissions checked via hasAuthority()/hasAnyAuthority().