title: Where exactly role based access control checks user's permissions in MVC pattern?
body: <p>I am implementing role-based access control in my simple PHP application. I am not using any frameworks. From the one hand, I have this essential for MVC pattern <code>Route</code> class, from another hand, I have <code>sidebar.php</code> file that contains links to all sections. </p>
  
  <p>My rbac implementation: user->role->permission.So, each user will have many roles and every role will have plenty of permissions.</p>
  
  <p>My task is that the user would be able to work with only allowed to its section on my website. </p>
  
  <p>The question is where exactly I should check user's permissions?
  One of the ideas is to show in <code>sidebar.php</code> only these sections which are allowed, but I don't feel good about this.</p>
  
  <p>What's the way you usually use? </p>
  
  <p>P.S.: Good article will help too.</p>