Can you please post some code to help me see what code you'd expect to work?

I think when provide custom MethodSecurityExpressionHandler bean and some other bean that include not only RoleHierarchy but also GrantedAuthorityDefaults, ApplicationContext, etc, we need to provide full function bean like this.

  @Bean
    MethodSecurityExpressionHandler customMethodSecurityExpressionHandler(RoleHierarchy roleHierarchy) {
        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
        expressionHandler.setRoleHierarchy(roleHierarchy);
        expressionHandler.setDefaultRolePrefix("...");
	this.expressionHandler.setApplicationContext(context);
        return expressionHandler;
    }

Additionally, when both a custom MethodSecurityExpressionHandler and RoleHierarchy are provided, is it necessary to configure them within the framework? @jzheaux

You are correct, @kse-music, this is covered in the reference specifically with respect to RoleHierarchy.

Since RoleHierarchy is used in multiple places, it should be published as a bean. This allows all Spring Security components to pick it up and then evaluate roles in the same way.

That said, I'd still like to give @plumarr the opportunity to respond in case I haven't correctly understood their question.

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

Closing due to lack of requested feedback. If you would like us to look at this issue, please provide the requested information and we will re-open the issue.