I probably planned to have this check as part of the user and role processing. But I ended up putting it in UsersController and RolesController. Still, there are refactorings that still need to be done in order to facilitate unit-testing of the auth part of the component. Actually enabling this method - effectively moving the substance of those checks out of XxxController and doen into this Permission class, might be just the trick.