Which Spring Security component is responsible for restricting access to application resources based on user roles?

The AccessDecisionManager is responsible for restricting access to application resources based on user roles in Spring Security. It evaluates user roles and permissions against the requested resource and decides whether access should be granted or denied. The other options play different roles in the Spring Security framework but are not primarily responsible for role-based access control.