Why doesn't @PreAuthorize work when a method calls another annotated method on 'this' (the same object)?

Method security is implemented via Spring AOP proxies wrapping the bean — the proxy intercepts calls made TO the bean from OUTSIDE (through the injected reference), but a call made from within the same object (self-invocation, e.g., this.approve()) goes directly to the real method, bypassing the proxy and therefore bypassing the security check entirely. The common fix is to move the annotated logic into a separate bean and inject/call it externally.