jbaruch/spring-security-ai
Secure AI agent APIs with Spring Security 7 - RBAC, method security, OAuth2, and per-user agent access control
90
90%
Does it follow best practices?
Impact
92%
1.24xAverage score across 3 eval scenarios
Passed
No known issues
Evaluation results
92%
24%Integrate Corporate SSO with AI Agent API
issuer-uri in application.yml
100%
100%
JwtAuthenticationConverter bean
100%
100%
roles claim name set
0%
100%
ROLE_ authority prefix set
0%
100%
Converter wired into filter chain
100%
100%
Lambda DSL for oauth2ResourceServer
100%
100%
No password grant
100%
100%
Password grant identified as removed
100%
100%
oauth2-resource-server dependency
0%
0%
authorizeHttpRequests used
100%
100%
100%
16%Secure an AI Agent REST API
Lambda DSL only
100%
100%
authorizeHttpRequests used
100%
100%
No legacy matchers
100%
100%
CSRF disabled
100%
100%
Stateless session
100%
100%
@EnableMethodSecurity present
100%
100%
@EnableWebSecurity present
100%
100%
Correct endpoint rules
100%
100%
DelegatingPasswordEncoder
0%
100%
InMemoryUserDetailsManager
100%
100%
OAuth2 resource server
0%
100%
85%
17%Role-Restricted AI Agent Tool Access
@PreAuthorize on @Tool methods
100%
100%
@PostAuthorize usage
0%
0%
Reusable meta-annotation
0%
41%
Meta-annotation structure
0%
100%
RoleHierarchy bean
100%
100%
Authentication param in controller
100%
100%
User name in system prompt
100%
100%
Authorities in system prompt
100%
100%
AccessDenied guidance in system prompt
100%
100%
@EnableMethodSecurity present
100%
100%
AgentTools passed to ChatClient
50%
100%
- Evaluated
- Agent
- Claude
- Model
- Claude Sonnet 4.6