O Guia Definitivo do Yii 1.1

class PostController extends CController
{
......
public function filters()
{
return array(
'accessControl',
);
}
}
In the above, we specify that the access control filter should be applied to every action of
PostController. The detailed authorization rules used by the filter are specified by
overriding CController::accessRules in the controller class.
class PostController extends CController
{
......
public function accessRules()
{
return array(
array('deny',
'actions'=>array('create', 'edit'),
'users'=>array('?'),
),
array('allow',
'actions'=>array('delete'),
'roles'=>array('admin'),
),
array('deny',
'actions'=>array('delete'),
'users'=>array('*'),
),
);
}
}
The above code specifies three rules, each represented as an array. The first element of
the array is either 'allow' or 'deny' and the other name-value pairs specify the pattern
parameters of the rule. The rules defined above are interpreted as follows: the create and
edit actions cannot be executed by anonymous users; the delete action can be executed
by users with admin role; and the delete action cannot be executed by anyone.