How do you enforce authorization/roles in a Wicket application?

Wicket separates authentication (who is this user) from authorization (what are they allowed to see or do), with the latter typically handled through the wicket-auth-roles module rather than scattering permission checks through page code.

1. Implement a Session subclass that exposes the current user's roles, typically extending AuthenticatedWebSession.
2. Register an authorization strategy in the Application's init(), commonly AnnotatedMountedRoleAuthorizationStrategy or the older RoleAuthorizationStrategy, which checks a component's required roles against the current session's roles before allowing it to render or be instantiated.
3. Annotate pages or components with @AuthorizeInstantiation("ADMIN") (or the equivalent programmatic call) to restrict who can even construct that page, so an unauthorized user gets redirected before any of the page's content is built at all.
4. Use finer-grained checks within a page for partial restrictions — hiding a specific button or panel for users lacking a role, rather than blocking the whole page.

Because the check happens at instantiation for page-level authorization, an unauthorized request never even runs the page's constructor logic, which is a meaningfully stronger guarantee than merely hiding a link in markup while leaving the underlying page reachable by URL.