access-control-rbac

The code implements conventional Spring Security RBAC and contains no evident malicious behavior. It has security configuration risks: matcher ordering can weaken post-specific permissions, CSRF is disabled globally, and the self-update principal comparison may be incorrect depending on the principal type. The post matchers should be reordered from most specific to least specific, and CSRF should be disabled only when the API authentication model makes that appropriate.