Permission management, usually using RBAC (Role-Based Access Control) mode.
R: role represents role, which mainly groups various permissions, such as administrator, editor, auditor, etc.
Specific ideas:
For each module of the program, you can consider each Controller or even refine the function of each controller. Give these modules a name, record it in the database, and mark it in the program.
Then associate this module with the role and record it in a table. For example, editing, the possible operating modules are writing articles, editing articles, etc.
Finally, associate the user with the role.
In this way, when a user wants to perform a certain operation (when accessing an action), the role of the current user can be read out. Then go to the role module corresponding table based on the role information to see if there is a record of the current operation module. If so, it means there is authorization.
The above is the basic idea, not only CI, but other frameworks can also be used