Camel Route for orchestrating services - asynchronous

Question

I have a Spring Boot based micro service (PolicyService) which is protected using Spring Security OAuth2 as a resource component.
So, a check , if the user is authenticated or not is done by validating the token received in the request using Authorization Server component.
Also, internally, within the service I check for Current User's Roles and ACE for requested object (for Update , Delete and Read operations ) to
determine if the current user has required permissions for executing target operation or not. I use Spring Security method level annotations for Role check and a custom ACL Service for domain object level permissions.
Once I determine, that the user is authenticated and also has the required authorizations for the requested operation and/or object,
a policy is created in the database.
Also, I call another operation in ACL Service from Policy Service to add ACE (access control entry) for the created object and the User.
If at any point there is a failure, I throw an exception as "access denied."
I now want to orchestrate this service using a Composite service based on Apache Camel.
I want to know if it it is better to separate out the steps for checking for authorizations using ACL Service
and also adding a ACL Entry once the policy is created , as separate steps in Apache camel.
As of now, they are all consumed by the Policy Service.
Also, I now have a requirement to do a validation for the Policy being created which is currently time consuming, so I want to use messaging by sending an event to a Queue which would be monitored by a service which validates and updates the database and sends a mail accordingly based on the outcome of the validation.
I want to know if it is better to extract these different functionalities as individual steps in a Camel Route as below or use them within the Policy Service.
If I extract the Role Check to the Composite Service, that means I need to add Spring Security to the Spring Boot based Apache Camel Composite Service to secure the service.
I currently do ACL permission check (not for Create but for other operations ) using Spring Security method level annotations and custom ACL Service. I believe I may have to redo the logic in a different way within the Camel Service now.
Also, which would be a better way to invoke the Policy Validation Service using asynchronous, messaging or by raising custom events using event-sourcing.
Also, is there any support in Apache Camel for raising custom events using event-sourcing and asynchronous service invocation
I currently have a route designed as below in Camel.
<route id="createPolicy">
<from uri="direct:createPolicy"/>
<!-- Check if User has the Role(s) required for this operation , handled internally by Policy Service using Spring Security-->
<bean ref="aclClientBean" method="checkRoleForCreatePolicy(${body})"/>
<!-- Create a Policy using Policy Service -->
<bean ref="policyClientBean" method="createPolicy(${body})"/>
<!-- Add ACE for Policy Instance and Current User using ACL Service , handled internally by Policy Service using ACL Service-->
<bean ref="aclClientBean" method="addACLForPolicy(${body})"/>
<!--Validating the Policy Details-->
<!-- Option 1:Send a message to a configured Policy Validation Queue which is monitored by Policy Validation Service -->
<!-- Option 2:Send a event that Policy is created, whoever interested on Policy Creation Event will subscribe to the event
and act accordingly when notified -->
<!-- Option 3:Asynchronously invoke the Policy Validation Service and validate the passed details -->
<bean ref="policyValidationClientBean" method="validatePolicyDetails(${body})"/>
<onException>
<exception>com.company.application.exception.AuthException</exception>
<handled>
<constant>true</constant>
</handled>
<to uri="direct:authException"/>
</onException>
<onException>
<exception>com.company.application.exception.APPException</exception>
<handled>
<constant>true</constant>
</handled>
<to uri="direct:appException"/>
</onException>
</route>
<route id="authException">
<from uri="direct:authException"/>
<log message="Access Denied."/>
<bean ref="policyOrchestratorClientBean" method="handleFailure('Access Denied.')"/>
</route>
<route id="appException">
<from uri="direct:appException"/>
<log message="Exception invoking Service"/>
<bean ref="policyOrchestratorClientBean" method="handleFailure('Exception invoking Service')"/>
</route>