src/Auth/SimpleRbacAuthorize.php
public function authorizeByControllerAndAction($user, Request $request) {
		$roleField = $this->_config['roleField'];
		extract($this->getControllerNameAndAction($request));
		$actionMap = $this->getActionMap();

		if (isset($actionMap[$name]['*'])) {
			if ($this->_isAllowedRole($user[$roleField], $actionMap[$name]['*'])) {
				return true;
			}
		}

		if (isset($actionMap[$name][$action])) {
			if ($this->_isAllowedRole($user[$roleField], $actionMap[$name][$action])) {
				return true;
			}
		}

		if ($this->config('undefinedActionsAreAllowed') === true) {
			return true;
		}

		return false;
	}
public function authorizeByControllerAndAction($user, Request $request) {
		$roleField = $this->_config['roleField'];
		extract($this->getControllerNameAndAction($request));
		$actionMap = $this->getActionMap();

		if (isset($actionMap[$name]['*'])) {
			if ($this->_isAllowedRole($user[$roleField], $actionMap[$name]['*'])) {
				return true;
			}
		}

		if (isset($actionMap[$name][$action])) {
			if ($this->_isAllowedRole($user[$roleField], $actionMap[$name][$action])) {
				return true;
			}
		}

		if ($this->config('undefinedActionsAreAllowed') === true) {
			return true;
		}

		return false;
	}
Checks if a role is granted access to a controller and action

@param array $user
@param Request $request
@return boolean