Info from the Spring docs:

The key thing to understand here is that the client code inside the main(..) of the Main class has a reference to the proxy. This means that method calls on that object reference will be calls on the proxy, and as such the proxy will be able to delegate to all of the interceptors (advice) that are relevant to that particular method call. However, once the call has finally reached the target object, the SimplePojo reference in this case, any method calls that it may make on itself, such as this.bar() or this.foo(), are going to be invoked against the this reference, and not the proxy. This has important implications. It means that self-invocation is not going to result in the advice associated with a method invocation getting a chance to execute.

More info on this can be found here:

http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/aop.html#aop-understanding-aop-proxies

You forgot to mention that if two annotated methods are in one class(methodA and methodB) and methodA is invoking methodB than logAction(…) will be invoked only once…

Assuming you are using Restful URL’s in that the URL identified a particular resource which users have/haven’t got access to I would look into Spring Security and in particular the Spring ACL framework.

This allows use to restrict access based upon the item being accessed. For example you might have a system where users belong to accounts and you wish that they can only access URL’s for their accounts. Spring ACL would be able to address this.

James