Security requirements for this operation — declared on the route's schema.security, or derived from its branded guards when OpenApiGeneratorOptions.deriveSecurity is configured (declared wins). Absent when neither applies, which leaves the operation inheriting the document-level requirement; an empty array marks it public, overriding that default.