How does Symfony's security component handle authentication and authorization, including the concept of voters for fine grained access control decisions?

Symfony's security component provides a comprehensive system for handling both authentication, meaning verifying who a user actually is, and authorization, meaning determining what that authenticated user is actually allowed to do, and for authorization decisions that go beyond simple role checks, Symfony introduces the concept of a voter, a dedicated class responsible for deciding whether a specific user should be granted access to perform a specific action on a specific object, such as whether a particular user is allowed to edit one specific blog post they may or may not actually own.

class PostVoter extends Voter
{
    protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
    {
        $user = $token->getUser();
        return $subject->getAuthor() === $user;
    }
}