@Override
    public void authorize(final HttpServletRequest request, final Service service, final Assertion assertion) {
        val registeredService = servicesManager.findServiceBy(service);
        RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(service, registeredService);

        LOGGER.debug("Evaluating service [{}] to ensure required authentication handlers can satisfy assertion", service);
        val primaryAuthentication = assertion.getPrimaryAuthentication();
        val attributes = primaryAuthentication.getAttributes();
        if (!attributes.containsKey(AuthenticationHandler.SUCCESSFUL_AUTHENTICATION_HANDLERS)) {
            LOGGER.warn("No successful authentication handlers are recorded for the authentication attempt");
            throw UnauthorizedServiceException.denied("Unauthorized: %s".formatted(service.getId()));
        }
        val successfulHandlerNames = CollectionUtils.toCollection(attributes.get(AuthenticationHandler.SUCCESSFUL_AUTHENTICATION_HANDLERS));
        val assertedHandlers = authenticationEventExecutionPlan.resolveAuthenticationHandlers()
            .stream()
            .filter(BeanSupplier::isNotProxy)
            .filter(handler -> successfulHandlerNames.contains(handler.getName()))
            .collect(Collectors.toSet());

        val policies = authenticationEventExecutionPlan.getAuthenticationPolicies(primaryAuthentication);
        policies.forEach(policy -> {
            try {
                val simpleName = policy.getClass().getSimpleName();
                LOGGER.trace("Executing authentication policy [{}]", simpleName);
                val result = policy.isSatisfiedBy(primaryAuthentication, assertedHandlers, applicationContext,
                    Map.of(Assertion.class.getName(), assertion, RegisteredService.class.getName(), registeredService));
                if (!result.isSuccess()) {
                    throw UnauthorizedServiceException.denied("Unauthorized: %s".formatted(service.getId()));
                }
            } catch (final Throwable e) {
                LoggingUtils.error(LOGGER, e);
                throw UnauthorizedServiceException.denied("Unauthorized: %s".formatted(service.getId()));
            }
        });
    }
This is {@link AuthenticationPolicyAwareServiceTicketValidationAuthorizer}.

@author Misagh Moayyed
@since 5.3.0
core/cas-server-core-validation-api/src/main/java/org/apereo/cas/validation/AuthenticationPolicyAwareServiceTicketValidationAuthorizer.java