Have you read the relevant sections of the Spring Security Guide, namely AccessDeniedHandler and the namespace application .
If you want more control, you can use
<http use-expressions="true">
<intercept-url pattern="/denied/*" access="permitAll" />
<access-denied-handler error-page="/denied">
</http>
Where /denieddisplays the web controller class you are writing. Make sure it is /denied/**not protected.
, , ?