O Guia Definitivo do Yii 1.1

The access rules are evaluated one by one in the order they are specified. The first rule
that matches the current pattern (e.g. username, roles, client IP, address) determines the
authorization result. If this rule is an allow rule, the action can be executed; if it is a deny
rule, the action cannot be executed; if none of the rules matches the context, the action
can still be executed.
Tip: To ensure an action does not get executed under certain contexts, it is beneficial
to always specify a matching-all deny rule at the end of rule set, like the following:
return array(
);
// ... other rules...
// the following rule denies 'delete' action for all contexts
array('deny',
),
'actions'=>array('delete'),
The reason for this rule is because if none of the rules matches a context, then the
action will continue to be executed.
An access rule can match the following context parameters:
• actions: specifies which actions this rule matches. This should be an array of action
IDs. The comparison is case-insensitive.
• controllers: specifies which controllers this rule matches. This should be an array of
controller IDs. The comparison is case-insensitive. This option has been available
since version 1.0.4.
• users: specifies which users this rule matches. The current user's name is used for
matching. The comparison is case-insensitive. Three special characters can be used
here:
• *: any user, including both anonymous and authenticated users.
• ?: anonymous users.
• @: authenticated users.
• roles: specifies which roles that this rule matches. This makes use of the role-based
access controlfeature to be described in the next subsection. In particular, the rule is
applied if CWebUser::checkAccess returns true for one of the roles. Note, you should
mainly use roles in an allowrule because by definition, a role represents a permission
to do something. Also note, although we use the term roles here, its value can
actually be any auth item, including roles, tasks and operations.
• ips: specifies which client IP addresses this rule matches.
• verbs: specifies which request types (e.g. GET, POST) this rule matches. The
comparison is case-insensitive.
• expression: specifies a PHP expression whose value indicates whether this rule
matches. In the expression, you can use variable $user which refers to Yii::app()-
>user. This option has been available since version 1.0.3.
Handling Authorization Result