Spring Security: @PreAuthorize secures a method, not a URL

@EnableMethodSecurity
@Configuration
class SecurityConfig { }

@Service
class OrderService {

    @PreAuthorize("hasRole('ADMIN') or #username == authentication.name")
    public List<Order> ordersOf(String username) { ... }

    @PostAuthorize("returnObject.owner == authentication.name")
    public Order byId(Long id) { ... }
}

An admin sees anyone's orders.
A user sees only their own - enforced in one line, next to the method it protects.