code: public function authorize($user, Request $request) {
  		$roleField = $this->_config['roleField'];
  
  		if (!isset($user[$roleField])) {
  			throw new RuntimeException(sprintf('The role field `%s` does not exist!', $roleField));
  		}
  
  		if (is_string($user[$roleField])) {
  			$user[$roleField] = array($user[$roleField]);
  		}
  
  		if ($this->authorizeByPrefix($user[$roleField], $request)) {
  			return true;
  		}
  
  		if ($this->authorizeByControllerAndAction($user, $request)) {
  			return true;
  		}
  
  		return false;
  	}
docs: Authorize a user based on his roles
  
  @param array $user The user to authorize
  @param Request $request The request needing authorization.
  @return boolean
  @throws RuntimeException when the role field does not exist