Have you had experience implementing new rules or logic in a Spring Security-based security system?

Yes, experience with implementing new security rules in Spring Security typically involves configuring or extending components such as filters, authentication providers, or access control settings.

For example, you might add a custom filter to check an additional token or implement your own UserDetailsService to load users with new attributes.

An example of configuring a custom access rule:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .antMatchers("/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
            .and()
            .formLogin();
    }
}

You can also inject logic via annotations, such as @PreAuthorize with SpEL expressions for finer access control.