code: public function isAuthorized($user, $plugin, $controller, $action) {
  		$isAuthorized = false;
  
  		if ($plugin) {
  			$plugin = Inflector::camelize($plugin);
  		}
  
  		if ($this->isPublicAction($plugin, $controller, $action)) {
  			$isAuthorized = true;
  		} elseif (isset($user['role']) && !empty($controller) && !empty($action)) {
  			if ($this->_options['camelizedControllerNames']) {
  				$controller = Inflector::camelize($controller);
  			} else {
  				$controller = Inflector::underscore($controller);
  			}
  
  			$key = $controller;
  			if (!empty($plugin)) {
  				$key = $plugin . '.' . $key;
  			}
  
  			if (isset($this->_rightsConfig[$key]['*']) && $this->_rightsConfig[$key]['*'] == '*') {
  				$isAuthorized = true;
  			} elseif (isset($this->_rightsConfig[$key]['*'])
  			&& in_array($user['role'], $this->_rightsConfig[$key]['*'])) {
  				$isAuthorized = true;
  			} elseif (isset($this->_rightsConfig[$key][$action])
  				&& in_array($user['role'], $this->_rightsConfig[$key][$action])) {
  
  				$isAuthorized = true;
  			}
  		}
  		return $isAuthorized;
  	}
docs: Checks whether the user has access to certain controller action
  
  @param array $user user to check
  @param string $plugin plugin name or null
  @param string $controller controller name
  @param string $action action
  @return bool