@Service
public class DocumentService {
    @PreAuthorize("@securityService.isOwner(#id) or hasRole('ADMIN')")
    public Document getDocument(Long id) {
        return repository.findById(id).orElseThrow();
    }
}
 
@Component("securityService")
public class SecurityService {
    public boolean isOwner(Long id) {
        String currentUser = SecurityContextHolder.getContext().getAuthentication().getName();
        // Database check logic here
        return true; 
    }
}