title: clarify biz rules for Yii's RBAC
body: <p>I wanted to try and get a clear idea on how to go about something with Yii's RBAC. I have an <code>item</code> table with <code>fk's</code> relating to the <code>user</code>. I'm using <code>CGridview</code> to give an option to <code>update</code> this DB record. And I've also started doing Access rules now.</p>
  
  <p><strong>Item Table</strong></p>
  
  <pre><code>- id
  - name
  ......
  - user_id
  </code></pre>
  
  <p><strong>My access rule:</strong></p>
  
  <pre><code>$auth-&gt;createOperation('updateOwnItem', 'User can update their own item', 'return $params["user_id"] == Yii::app()-&gt;user-&gt;id;');
  </code></pre>
  
  <p>So for instance I may have a link to update the file that is: </p>
  
  <p><code>www.example.com/item/update/2</code></p>
  
  <p><strong>Controller</strong></p>
  
  <pre><code>    public function actionUpdate($id) {
  
      if(!Yii::app()-&gt;user-&gt;checkAccess('updateOwnItem', array('user_id'=&gt;Yii::app()-&gt;user-&gt;id))) {
  
          throw new CHttpException(403, 'No access.');
      }
  
  // Rest of controller
  </code></pre>
  
  <p>That always returns "no access" though. </p>
  
  <p>The rest of my rules work though, can anyone spot what might be wrong here? Additionally I overwrote the <code>getId()</code> method so my user->id does return the user ID.</p>
  
  <p>Thanks in advance</p>