Гибкая настройка разрешений для ролей RBAC

return array(
    'guest' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Гость',
        'bizRule' => null,
        'data' => null
    ),
 
    'user' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Пользователь',
        'children' => array(
            'guest',
        ),
        'bizRule' => null,
        'data' => null
    ),
 
    'moderator' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Модератор',
        'children' => array(
            'user',
        ),
        'bizRule' => null,
        'data' => null
    ),
 
    'administrator' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Администратор',
        'children' => array(
            'moderator', // позволим админу всё, что позволено модератору
        ),
        'bizRule' => null,
        'data' => null
    ),
);

class PostAdminController extends СController
{
    public function filters()
    {
        return array(
            'accessControl',
        );
    }
 
    public function accessRules()
    {
        return array(
            array('allow',
                'roles'=>array('administrator'),
            ),
            array('deny',
                'users'=>array('*'),
            ),
        );
    }
}

class CommentAdminController extends СController
{
    public function filters()
    {
        return array(
            'accessControl',
        );
    }
 
    public function accessRules()
    {
        return array(
            array('allow',
                'roles'=>array('moderator'),
            ),
            array('deny',
                'users'=>array('*'),
            ),
        );
    }
}

class PostAdminController extends СController
{
    public function filters()
    {
        return array(
            'accessControl',
        );
    }
 
    public function accessRules()
    {
        return array(
            array('allow',
                'roles'=>array('m_blogs'),
            ),
            array('deny',
                'users'=>array('*'),
            ),
        );
    }
}

class CommentAdminController extends СController
{
    public function filters()
    {
        return array(
            'accessControl',
        );
    }
 
    public function accessRules()
    {
        return array(
            array('allow',
                'roles'=>array('m_comments'),
            ),
            array('deny',
                'users'=>array('*'),
            ),
        );
    }
}

return array(
 
    /* Разрешения */
 
    'profile' => array(
        'type' => CAuthItem::TYPE_OPERATION,
        'description' => 'Доступ в личный кабинет',
        'bizRule' => null,
        'data' => null
    ),
 
    'forum' => array(
        'type' => CAuthItem::TYPE_OPERATION,
        'description' => 'Доступ в форум',
        'bizRule' => null,
        'data' => null
    ),
 
    'control_panel' => array(
        'type' => CAuthItem::TYPE_OPERATION,
        'description' => 'Доступ в панель управления',
        'bizRule' => null,
        'data' => null
    ),
 
    'm_comments' => array(
        'type' => CAuthItem::TYPE_OPERATION,
        'description' => 'Управление комментариями',
        'bizRule' => null,
        'data' => null
    ),
 
    'm_pages' => array(
        'type' => CAuthItem::TYPE_OPERATION,
        'description' => 'Управление страницами',
        'bizRule' => null,
        'data' => null
    ),
 
    'm_users' => array(
        'type' => CAuthItem::TYPE_OPERATION,
        'description' => 'Управление пользователями',
        'bizRule' => null,
        'data' => null
    ),
 
    'm_blogs' => array(
        'type' => CAuthItem::TYPE_OPERATION,
        'description' => 'Управление блогом',
        'bizRule' => null,
        'data' => null
    ),
 
    /* Роли */    
 
    'role_guest' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Гость',
        'bizRule' => null,
        'data' => null
    ),
 
    'role_user' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Пользователь',
        'children' => array(
            'role_guest',
            'profile'
        ),
        'bizRule' => null,
        'data' => null
    ),
 
    'role_active_user' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Принятый пользователь',
        'children' => array(
            'role_user',
            'forum'
        ),
        'bizRule' => null,
        'data' => null
    ),
 
    'role_moderator' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Модератор',
        'children' => array(
            'role_active_user',
            'control_panel',
            'm_comments',
            'm_users',
        ),
        'bizRule' => null,
        'data' => null
    ),
 
    'role_manager' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Контент-менеджер',
        'children' => array(
            'role_active_user',
            'control_panel',
            'm_blogs',
            'm_pages',
        ),
        'bizRule' => null,
        'data' => null
    ),
 
    'role_admin' => array(
        'type' => CAuthItem::TYPE_ROLE,
        'description' => 'Администратор',
        'children' => array(
            'role_active_user',
            'control_panel',
            'm_pages',
            'm_blogs',
            'm_comments',
            'm_users',
        ),
        'bizRule' => null,
        'data' => null
    ),
);