Annotation-driven Guard implementations backed by Spring Security. Reads @RequiresScope / @RequiresRole off user handler methods at startup and attaches corresponding Guards via the per-handler customizer SPI. Guard denial hides the handler at list time and rejects calls with JSON-RPC -32003. Code-only module; the matching autoconfig lives in mocapi-autoconfigure.