code: protected boolean shouldAuthorize(Authentication authentication) {
          Assert.state(getAccessDecisionManager() != null, "The AccessDecisionManager can not be null!");
          boolean authorize = false;
          try {
              if( authentication != null ) {
                  Object securedObject = getSecuredObject();
                  List<ConfigAttribute> cad = getConfigAttributeDefinition( securedObject );
                  getAccessDecisionManager().decide( authentication, getSecuredObject(), cad );
                  authorize = true;
              }
          } catch( AccessDeniedException e ) {
              // This means the secured objects should not be authorized
          }
          return authorize;
      }
docs: Determine if our controlled objects should be authorized based on the provided
  authentication token.
  @param authentication token
  @return true if should authorize