@Service
@Transactional
public class UserService {

    @Autowired
    private UserRepository userRepository;

    @PreAuthorize("#id eq principal or hasRole('ADMIN')")
    public UserDto doStuffWithUser(UUID id) {
        if (!userRepository.existsById(id)) {
            throw new NotFoundException();  // 404
        }

        // do stuff...
    }

}