title: yii ACL for different user roles
body: <p>This question may be basic and has been asked before, but I couldn't find it.
  I'm using Yii and I get trouble when differentiating users with action's access.
  I have a table called tbl_user, with fields like username, password, and role. When a user login, the system will set the loginAs state with his/her role, for example:</p>
  
  <pre><code>$role = "Super User"; //assume we get this role by querying the tbl_user
  Yii::app()-&gt;user-&gt;setState("loginAs", $role)
  </code></pre>
  
  <p>In a controller, there are 4 actions, actionIndex, actionCreate, actionUpdate, and actionDelete. If a super user logins, these 4 action will be available. But if another user with different role logins, for example "administrator", all but actionDelete will be available. I tried this:</p>
  
  <pre><code>public function accessRules()
  {
      return array(
          array('allow',
              'actions'=&gt;array('index','create','update','delete'),
              'expression'=&gt;'Yii::app()-&gt;user-&gt;getState("loginAs")=="Super User"'
          ),
          array('allow',
              'actions'=&gt;array('index','create','update'),
              'expression'=&gt;'Yii::app()-&gt;user-&gt;getState("loginAs")=="Administrator"',
          ),
      );
  }
  </code></pre>
  
  <p><strong>EDITED</strong></p>
  
  <p>The code above doesn't work. When I login as Administrator, I get error 403 for all 4 actions. <strong>Administrator should be able to access all except "delete"</strong>. Is there another way for this? Any help will be appreciated.</p>