yii\filters\AccessRule::matchCalllback. 注意传递的参数 $rule, $action

[
    'actions' => ['special-callback'],
    'allow' => true,
    'matchCallback' => function ($rule, $action) {
        # write arbitrary access check logic
        # permission = (rule [xxoo] action)
        # return user->can(permission);
    }
]

或者使用下面的方式, 见 yii2-admin

return [
    'components' => [
        'authManager' => [
            'class' => 'yii\rbac\PhpManager', // or use 'yii\rbac\DbManager'
        ]
    ],
    'as access' => [
        'class' => 'mdm\admin\components\AccessControl',
    ],
];

AccessControl 支持配置 role

例如：

[
    'actions' => ['edit'],
    'allow' => true,
    'roles' => ['@', 'author'],
],