Why doesn't an @EventListener for AuthorizationDeniedEvent fire even though the code compiles fine?

Unlike authentication events, which are published automatically, authorization event publishing must be explicitly opted into by exposing an AuthorizationEventPublisher bean (typically a SpringAuthorizationEventPublisher wrapping the ApplicationEventPublisher). Without this bean, authorization checks still work correctly, but no event is ever published, so any listener silently never fires — with no error to indicate why.