title: CakePHP 2.x ACL - Control at owner level
body: <p>I am able to control my application using <code>ACL</code>, everything done perfectly and application is working smooth with <code>ACL</code> and <code>Auth</code>.</p>
  
  <p>Now the problem is:</p>
  
  <p>I have two tables, <code>users</code> and <code>posts</code>. there is no <code>RBAC</code> (role based access control).
  I am setting <code>deny</code> and <code>allow</code> for each user like follow.</p>
  
  <pre><code>//allow User1 to do everything
  $user-&gt;id=1;
  $this-&gt;ACL-&gt;allow($user,'controllers');
  
  //allow User2 to add, edit and view the posts 
  $user-&gt;id=2;
  $this-&gt;Acl-&gt;deny($user, 'controllers');
  $this-&gt;Acl-&gt;allow($user, 'controllers/Posts');
  </code></pre>
  
  <p>but here I am getting one problem:</p>
  
  <p><code>user2</code> is getting access to <code>edit</code> the <code>posts</code> of <code>user1</code>.</p>
  
  <p>example: </p>
  
  <p><code>User1</code> created a <code>post1</code>.</p>
  
  <p>now <code>User2</code> logged in now he can edit the <code>User1</code>'s post (i.e. <code>post1- /localhost/myApp/posts/edit/1</code>)</p>
  
  <p><strong>Question: How can I set ACL permission to this problem, The owner of the post can only edit the post and others can not.</strong></p>
  
  <p>I can achieve this in controller level simply checking </p>
  
  <pre><code>if($_SESSION['Auth']['User']['id'] == $Post['Post']['user_id']){
      // you're the owner, so u can edit
  }else{
      //u cant edit, this is not ur post
  }
  </code></pre>
  
  <p>but I need <code>ACL</code> to work here, Is it possible?, Please help</p>
  
  <p>Thanks</p>