docs: protected Set<String> mergeAuthorities(List<String> userGrants, List<String> systemGrants) {
          Set<String> authorities = userGrants == null ? new HashSet<>() : new HashSet<>(userGrants);
          
          for (String grantedAuthority : systemGrantedAuthorities) {
              if (grantedAuthority.startsWith("-")) {
                  authorities.remove(grantedAuthority.substring(1));
              } else {
                  authorities.add(grantedAuthority);
              }
          }
          
          return authorities;
      }