On admin_controller.php you can decide what to protect.

By default we have

var $protect_all_actions = true;

which means that all the actions under the admin controller/module will be added to the permission table once they're first acceded by a super-user.

If you want fine-grain access control the best way is to use the User::can() method. That will also add the permission the first time it's accessed.

So it's as simple as using

if(User::can('Moderate comments', 'Forum')){
    //
}

to get a new Forum permission group with the moderation task.

Ok, so I know how to modify and add protection ABOUT the admin controller inside the admin controller.

What about other controllers and actions?

What do I add to an existing controller, say the 'order_controller.php'? What functions & variables do I need to add?
(So when someone goes to /APPNAME/order, they get authenticated)

Or do I do all my other_controller controlling inside the admin_controller?

Ok, I'm getting some success, but haven't figured out how to get away from the action=>protected_action errors.

Here is what I did.

1) Copied functions authenticate(), access_denied(), _protectAction(), and _protectAllActions() to the application_controller.php

2) Block commented out those functions inside admin_controller.php (so we don't have duplicate code).

3) Inside order_controller.php I added the following lines:

var $protected_actions = 'list_warehouses'; // only protecting one action for testing purposes.
function __construct()
{
    $this->beforeFilter('authenticate');
    !empty($this->protected_actions) ? $this->beforeFilter('_protectAction') : null;
    !empty($this->protect_all_actions) ? $this->beforeFilter(array('_protectAllActions' => array('except'=>'action_privileges_error'))) : null;
}

/order/listing/ works as normal (not protected, no authentication going on) /order/list_warehouses/ 1st prompts me for a password (just like /admin/), but once I am logged in, it tries to go to /order/protected_action (Obviously this action does not exist). This is due to this line in _protectAction():

$this->redirectTo(array('action'=>'protected_action'));

If I replace 'protected_action' with $action_name, I get "This webpage has a redirect loop". (I understand why it's a loop.) If I the redirectTo with

$this->renderAction($action_name);

Then I get a load of other errors (because the actual action is not being used, just the tpl file).

I'll look into this after lunch a bit more. :-)

I'm accessing as an account with an admin role, yes. Interesting. When I go to /admin/permissions/manage/, I do not see any lines for Admin::Order.

But the Extensions table has and 'Admin::Order' with an ID of 10. Yet the Permissions table has NO fields with an extension_id of 10. That would explain why nothing is showing up in /admin/permissions/manage.

It seems the auto-adding of accessed actions is not working quite right. But it DID add the 'extension' (controller name), just not the permission (action). I'll keep digging.