title: Why is the default Spring Security strategy AffirmativeBased?
body: <p>From the <a href="http://docs.spring.io/spring-security/site/docs/3.0.x/reference/ns-config.html#ns-access-manager" rel="nofollow">spring security docs</a> for AccessDecisionManager:</p>
  
  <blockquote>
    <p>The default strategy is to use an AffirmativeBased AccessDecisionManager with a RoleVoter and an AuthenticatedVoter.</p>
  </blockquote>
  
  <p>The <a href="http://docs.spring.io/spring-security/site/docs/3.2.7.RELEASE/apidocs/org/springframework/security/access/vote/AffirmativeBased.html" rel="nofollow">AffirmativeBased</a> voter:</p>
  
  <blockquote>
    <p>grants access if <em>any</em> AccessDecisionVoter returns an affirmative response</p>
  </blockquote>
  
  <p>According to the docs, the RoleVoter will vote based on whether the authenticated object has the correct ROLE_ authority, and the AuthenticatedVoter based on whether or not the object is authenticated.</p>
  
  <p>My confusion is, what is the AuthenticatedVoter object voting on? In my application I only want someone with ROLE_USER to access a resource. But I'm also setting setAuthenticated(true) on my implementation of the AbstractAuthenticationToken.</p>
  
  <p>From reading of the docs the AffirmativeBased strategy would only need authenticated to be true to access the resource and wouldn't bother with the ROLE requirement. Is there a different "is authenticated" value that's actually being checked?</p>
  
  <p>I know about the UnanimousBased strategy, but it seems like I haven't understood the authenticated test or else there would be a big security hole in the default implementation.</p>