code: @Override
      public boolean hasPermission(User user, E entity, Permission permission) {
  
          // always grant READ access ("unsecured" object)
          if (permission.equals(Permission.READ)) {
              LOG.trace("Granting READ access on " + entity.getClass().getSimpleName() + " with ID " + entity.getId());
              return true;
          }
  
          // call parent implementation
          return super.hasPermission(user, entity, permission);
      }
docs: Grants READ permission on the user object of the currently logged in
  user. Uses default implementation otherwise.