In our security checker example, without applying the @SecurityCheck annotation to the MessageService.save() method, the code execution flows directly from the MessageController.saveMessage() method to the MessageService.save() method. After applying the @SecurityCheck annotation, during runtime, the code execution flows from the MessageController.saveMessage() method to the AOP proxy object that Spring AOP creates. In our example, MessageService doesn't implement any interface, so the AOP proxy object is an instance of the MessageService subclass that Spring AOP creates with CGLIB. From the AOP proxy object, the execution flows to the checkSecurity() advisor. Inside the advisor, the MessageService.save() target method is invoked. And later, after MessageService.save() completes, the execution flows back to the MessageController.saveMessage() method. The following Figure 3.8 demonstrates the execution flow with AOP: