code: public function authorizeByControllerAndAction($user, Request $request) {
  		$roleField = $this->_config['roleField'];
  		extract($this->getControllerNameAndAction($request));
  		$actionMap = $this->getActionMap();
  
  		if (isset($actionMap[$name]['*'])) {
  			if ($this->_isAllowedRole($user[$roleField], $actionMap[$name]['*'])) {
  				return true;
  			}
  		}
  
  		if (isset($actionMap[$name][$action])) {
  			if ($this->_isAllowedRole($user[$roleField], $actionMap[$name][$action])) {
  				return true;
  			}
  		}
  
  		if ($this->config('undefinedActionsAreAllowed') === true) {
  			return true;
  		}
  
  		return false;
  	}
docs: Checks if a role is granted access to a controller and action
  
  @param array $user
  @param Request $request
  @return boolean