O Guia Definitivo do Yii 1.1

Using Business Rules
When we are defining the authorization hierarchy, we can associate a role, a task or an
operation with a so-called business rule. We may also associate a business rule when we
assign a role to a user. A business rule is a piece of PHP code that is executed when we
perform access checking. The returning value of the code is used to determine if the role
or assignment applies to the current user. In the example above, we associated a
business rule with the updateOwnPost task. In the business rule we simply check if the
current user ID is the same as the specified post's author ID. The post information in the
$params array is supplied by developers when performing access checking.
Access Checking
To perform access checking, we first need to know the name of the authorization item. For
example, to check if the current user can create a post, we would check if he has the
permission represented by the createPost operation. We then call
CWebUser::checkAccess to perform the access checking:
if(Yii::app()->user->checkAccess('createPost'))
{
// create post
}
If the authorization rule is associated with a business rule which requires additional
parameters, we can pass them as well. For example, to check if a user can update a post,
we would pass in the post data in the $params:
$params=array('post'=>$post);
if(Yii::app()->user->checkAccess('updateOwnPost',$params))
{
// update post
}
Using Default Roles
Note: The default role feature has been available since version 1.0.3
Many Web applications need some very special roles that would be assigned to every or
most of the system users. For example, we may want to assign some privileges to all
authenticated users. It poses a lot of maintenance trouble if we explicitly specify and store
these role assignments. We can exploit default roles to solve this problem.
A default role is a role that is implicitly assigned to every user, including both authenticated
and guest. We do not need to explicitly assign it to a user. When CWebUser::checkAccess
is invoked, default roles will be checked first as if they are assigned to the user.