@Retention(RetentionPolicy.RUNTIME)
@Inherited
@Documented
@PreAuthorize(AllowedForSystemUsers.condition)
public @interface AllowedForSystemUsers {
    String condition = "hasAnyRole({'ROLE_ADMIN', 'ROLE_USER'})";
}

@RequestMapping(value="/search", method=RequestMethod.POST)
@AllowedForSystemUsers
public String searchRooms(@ModelAttribute Booking booking, Model model, long type) {

    //do something
}

@ExceptionHandler(value = AccessDeniedException.class)
public ModelAndView accessDenied(HttpServletRequest request, HttpServletResponse response, AccessDeniedException e) {

    return new ModelAndView("redirect:/error");
}