Add ConditionalAuthorizationManager

Closes gh-18919

docs/modules/ROOT/pages/servlet/authorization/architecture.adoc

@@ -144,6 +144,16 @@ Another manager is the `AuthenticatedAuthorizationManager`.
 It can be used to differentiate between anonymous, fully-authenticated and remember-me authenticated users.
 Many sites allow certain limited access under remember-me authentication, but require a user to confirm their identity by logging in for full access.
 
+[[authz-conditional-authorization-manager]]
+==== ConditionalAuthorizationManager
+javadoc:org.springframework.security.authorization.ConditionalAuthorizationManager[] delegates to one of two ``AuthorizationManager``s based on a condition evaluated against the current ``Authentication``.
+When the condition returns true (and the authentication is non-null), the ``whenTrue`` manager is used; otherwise the ``whenFalse`` manager is used.
+Create an instance using the builder returned by `ConditionalAuthorizationManager.when(Predicate<Authentication>)`: set `whenTrue` (required) and optionally `whenFalse` (defaults to permit-all).
+This is useful for scenarios such as requiring multi-factor authentication only when the user has registered a second factor.
+
+.ConditionalAuthorizationManager example
+include-code::./ConditionalAuthorizationManagerExample[tag=conditionalAuthorizationManager,indent=0]
+
 [[authz-authorization-manager-factory]]
 === Creating AuthorizationManager instances
 

docs/modules/ROOT/pages/whats-new.adoc

@@ -5,6 +5,7 @@
 
 * https://github.com/spring-projects/spring-security/pull/18634[gh-18634] - Added javadoc:org.springframework.security.web.util.matcher.InetAddressMatcher[]
 * https://github.com/spring-projects/spring-security/issues/18755[gh-18755] - Include `charset` in `WWW-Authenticate` header
+* Added xref:servlet/authorization/architecture.adoc#authz-conditional-authorization-manager[ConditionalAuthorizationManager]
 
 == OAuth 2.0