Challenge 2 / 2

Our voter needs to know whether the target user - the one we're switching to - is an admin. We injected the Security service and wrote:

return !$this->security->isGrantedForUser($subject, 'ROLE_ADMIN');

Why not the more familiar $this->security->isGranted('ROLE_ADMIN')?

isGranted() skips role_hierarchy, so ROLE_ADMIN would only match users who have it listed literally.

isGranted() can't be called from inside a voter, because it would re-enter the access decision and recurse forever.

isGranted() only ever answers for the currently logged-in user - here, the admin doing the switching, not the one being switched to.

Both would work, but isGranted() is deprecated in favor of isGrantedForUser().