I have a bunch of controllers for updating database entities. All entities are tied to an organization. The logged in user has access to a few organization . How can I restrict access to these entities to only those users that have the authorization? One way is to check in each controller before each CRUD operation for authorization, but that is just ugly. Any better approach out there? Like something in Spring Security?