B>@PreAuthorize("hasRole('PERMISSION_UPDATE_ANY_PRODUCT') or (hasRole('PERMISSION_UPDATE_OWN_PRODUCT') and #product.author==authentication.name)") B>void processProduct() { B> ... B>} B>