If we're really doing this, I'd suggest:

"access_control"={
    "precondition"="...",
    "postcondition"="...",
},

Sub-attributes are too verbose, I prefer this approach (see my comment in the related issue).

"security" and "late_security" are really confusing names.

If you don't want nested attributes, then perhaps:

• access_control_precondition
• access_control_postcondition

Or:

• authorize_precondition
• authorize_postcondition

The second option would fit nicely with my suggestion of renaming DenyAccessListener to AuthorizeListener. And of course we could support "authorize"=false.

I don't buy the argument that Symfony uses the term "security" too. It's not related to our case.

Awesome! Thanks @vincentchalamon

Hello,
i'm not sure to understand the fix applied.
I use API Platform 2.6.4 with security annotation on itemOperation. But when i call this endpoint with unauthorized user, API Platform responds 404 when entity doesn't exist, and 403 when entity exist.

security attribute is not early by default ?

security is executed only after reading data, so you could have dynamic security by object data, if you want to not expose that item exist you could use security acl for that

security is executed only after reading data, so you could have dynamic security by object data, if you want to not expose that item exist you could use security acl for that

Ok thank you, i'll do that.
I was hopping that we can bypass this behavior with a parameter.