Real World Example

Marketplaces like Flipkart, Amazon and Meesho have the same three groups ShopEase has: buyers, sellers (with a separate seller portal) and internal staff. Staff are further split by permission: a support agent can see orders and issue small refunds, a finance user can approve large refunds, and only a few admins can block sellers. This is exactly roles (coarse) plus authorities (fine).

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    static RoleHierarchy roleHierarchy() {
        return RoleHierarchyImpl.withDefaultRolePrefix()
                .role("ADMIN").implies("SELLER")
                .role("SELLER").implies("CUSTOMER")
                .build();
    }

    @Bean
    SecurityFilterChain api(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers(HttpMethod.GET, "/api/products/**", "/api/categories/**").permitAll()
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/api/seller/**").hasRole("SELLER")
                .requestMatchers(HttpMethod.POST, "/api/orders/*/refund").hasAuthority("order:refund")
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/cart/**", "/api/orders/**").hasRole("CUSTOMER")
                .anyRequest().authenticated())
            .httpBasic(Customizer.withDefaults());
        return http.build();
    }
}