code: protected Set<String> mergeAuthorities(List<String> userGrants, List<String> systemGrants) {
          Set<String> authorities = userGrants == null ? new HashSet<>() : new HashSet<>(userGrants);
          
          for (String grantedAuthority : systemGrantedAuthorities) {
              if (grantedAuthority.startsWith("-")) {
                  authorities.remove(grantedAuthority.substring(1));
              } else {
                  authorities.add(grantedAuthority);
              }
          }
          
          return authorities;
      }
docs: Merges authorities granted (or revoked) by the system with those granted by the security
  domain.
  
  @param userGrants Authorities granted by the security domain.
  @param systemGrants Authorities granted by the system.
  @return A merged set of granted authorities.