AuthorizationManagerAfterMethodInterceptor creates interceptors using the PostAuthorizeAuthorizationManager. However, the order of those interceptors are hard-coded with 500. It should use the value provided by AuthorizationInterceptorsOrder.POST_AUTHORIZE.getOrder()

See https://github.com/spring-projects/spring-security/blob/5dae6da15abc54efd6817d453e5002835e59cef6/core/src/main/java/org/springframework/security/authorization/method/AuthorizationManagerAfterMethodInterceptor.java#L96