What is the role of the wicket-auth-roles module?

wicket-auth-roles is the optional module that provides the concrete role-based authorization machinery Wicket itself doesn't bundle into its core package by default.

It supplies the annotations (@AuthorizeInstantiation, @AuthorizeAction) developers attach to pages and components, along with the strategy classes (like AnnotatedMountedRoleAuthorizationStrategy) that read those annotations at runtime and compare required roles against whatever roles the current Session reports. It deliberately doesn't dictate where those roles come from — a database, an LDAP directory, a Spring Security context — that plumbing is the application's responsibility inside its own Session subclass; the module only handles the "check the required role against the current user's roles" enforcement layer once that data is available.

Keeping authorization as a separate, optional module (rather than baked into core) matches Wicket's general philosophy of composable pieces — applications that don't need role-based access control at all don't have to carry the module's dependencies or complexity.