title: Spring security, how to restrict user access certain resources based on dynamic roles?
body: <p>given a scenario , there is a HTML contents <strong>OR</strong> some method in a controller, which only allow to be access by "a" role.</p>
  
  <p>from above, we achieve by using <strong>@hasRole("a")</strong></p>
  
  <p>However, in my case, the role is dynamic:</p>
  
  <p><strong>Example, admin add a new role "b", and able to be access these content.
  So how to do it?</strong></p>
  
  <ol>
  <li><p>I tried ACL, but that's only protect the domain object with an id.    </p></li>
  <li><p>there is an annotation called hasAuthority, but i cant search
      anythings from internet.</p></li>
  <li><p>there is an ObjectIdentityImpl, not really
      how to implement.</p></li>
  </ol>