There are a number of places in Spring Security that issue granted authorities based on the principal, or loosely based on the principal. Here are a few:

• AuthoritiesPopulator
• GrantedAuthoritiesMapper
• AuthorityGranter
• JwtGrantedAuthoritiesConverter
• OpaqueTokenAuthenticationProvider

It would be nice to create a common abstraction that each of these could adapt to and that each authentication provider can be easily configured with:

interface GrantedAuthoritiesProvider<P> extends Converter<P, Collection<GrantedAuthority>>

This will allow for configuring each authentication provider to issue authorities dynamically and independently from the user itself, since not all authorities are direct properties of the user.