core/src/main/java/org/springframework/security/access/intercept/AbstractSecurityInterceptor.java
protected Object afterInvocation(InterceptorStatusToken token, Object returnedObject) {
		if (token == null) {
			// public object
			return returnedObject;
		}

		finallyInvocation(token); // continue to clean in this method for passivity

		if (afterInvocationManager != null) {
			// Attempt after invocation handling
			try {
				returnedObject = afterInvocationManager.decide(token.getSecurityContext()
						.getAuthentication(), token.getSecureObject(), token
						.getAttributes(), returnedObject);
			}
			catch (AccessDeniedException accessDeniedException) {
				AuthorizationFailureEvent event = new AuthorizationFailureEvent(
						token.getSecureObject(), token.getAttributes(), token
								.getSecurityContext().getAuthentication(),
						accessDeniedException);
				publishEvent(event);

				throw accessDeniedException;
			}
		}

		return returnedObject;
	}
protected Object afterInvocation(InterceptorStatusToken token, Object returnedObject) {
		if (token == null) {
			// public object
			return returnedObject;
		}

		finallyInvocation(token); // continue to clean in this method for passivity

		if (afterInvocationManager != null) {
			// Attempt after invocation handling
			try {
				returnedObject = afterInvocationManager.decide(token.getSecurityContext()
						.getAuthentication(), token.getSecureObject(), token
						.getAttributes(), returnedObject);
			}
			catch (AccessDeniedException accessDeniedException) {
				AuthorizationFailureEvent event = new AuthorizationFailureEvent(
						token.getSecureObject(), token.getAttributes(), token
								.getSecurityContext().getAuthentication(),
						accessDeniedException);
				publishEvent(event);

				throw accessDeniedException;
			}
		}

		return returnedObject;
	}
protected Object afterInvocation ( InterceptorStatusToken token , Object returnedObject ) { if ( token == null ) { // public object return returnedObject ; } finallyInvocation ( token ) ; // continue to clean in this method for passivity if ( afterInvocationManager != null ) { // Attempt after invocation handling try { returnedObject = afterInvocationManager . decide ( token . getSecurityContext ( ) . getAuthentication ( ) , token . getSecureObject ( ) , token . getAttributes ( ) , returnedObject ) ; } catch ( AccessDeniedException accessDeniedException ) { AuthorizationFailureEvent event = new AuthorizationFailureEvent ( token . getSecureObject ( ) , token . getAttributes ( ) , token . getSecurityContext ( ) . getAuthentication ( ) , accessDeniedException ) ; publishEvent ( event ) ; throw accessDeniedException ; } } return returnedObject ; }
Completes the work of the <tt>AbstractSecurityInterceptor</tt> after the secure
object invocation has been completed.

@param token as returned by the {@link #beforeInvocation(Object)} method
@param returnedObject any object returned from the secure object invocation (may be
<tt>null</tt>)
@return the object the secure object invocation should ultimately return to its
caller (may be <tt>null</tt>)
Completes the work of the <tt > AbstractSecurityInterceptor< / tt > after the secure object invocation has been completed .