CActiveRecord::instantiate can return null

If a model overrides the method instantiate($attributes) and decides to returns null for specific attributes, this model will not be populated.

For example, if a user has only permission to see records where type == 'a', the model would have the method instantiate($attributes) and if type == 'a' null would be returned.
Then, the controller can simply select all data (->findAll()) and will only get the records where the function instantiate($attributes) did not return null.