Method security applies access control directly on service methods using annotations. This is more granular than URL-based rules: you can check roles, evaluate SpEL expressions against method arguments, verify that the authenticated user owns the resource, and filter collections in return values — all declaratively.