function {callback}() {
parent::{callback}();
}

Just replace {callback} with the callback function you are performing: beforeSave, beforeFind, etc.

If you display dependent models on your forms they will be displayed regardless of the user_id set on them.

I need to look for another solution or continue with updating all controllers. No quick wins so far.

Thanks anyway

Now, I have one concern. Above solution is assuming admin/no admin roles. And assumes authentication does not allow non users to access models in question. Although these assumptions make the solution safe, they make it limited.

In systems where access should be restricted to owner data (e.g. medical data should not be available to admins, non doctors) and is rather role based then an admin/no admin attribute above solution is missing prevent access feature. If user_id is not set filter will return all rows. Imagine, you have not set up properly login/non login access to a certain model. The same goes for save. If user_id is not set it will allow saving any hacked id.

The simple solution is to add a line to both methods:
else (user_id not set)
impossible to meet condition (- to return empty set)

Still the idea is great and I will expand it to my needs. I thought I will point the above out so if you intend to expand the solution you have it in mind.

However, I’m wondering if you could help as I’m a bit confused with how the beforeFilter() works in this case.

In the Posts Controller there is, for example:
function beforeFilter() {
parent::beforeFilter();
$this->Auth->allowedActions = array(‘index’);
}

When not logged in, a user can see all posts in the index but when logged in, they can only see their own posts.

I’d like them to still see all the posts in index but only be able to edit their own eg. $this->Auth->deny(‘delete’,'edit’,'add’).
How does this work with this function? Should the beforeFilter be in the Model?
Sorry if I’ve missed something glaringly obvious!

I’m wondering what solution you have for menus/UI. What logic do you use to make visible/hide options from unauthorised users? I am thinking of a single ‘centralized’ method for both the SQL limiting and the UI options.