Maxim Mironjuk
-
March 22, 2025
Magento 2 governs every click in the backend through a hierarchical Admin ACL system: acl.xml declares the resource tree, roles under System, Permissions, User Roles bind administrators to exactly the resources they need, and isAllowed() checks in controllers, blocks and view models enforce those rights at runtime. Anyone who builds custom modules without declaring their own ACL resources exposes new admin functionality by default to every role that has access to the parent resource, a risk that often only surfaces during the next role audit. This article shows how to build the resource tree correctly, model custom ACL resources for custom modules, check permissions in controllers and view models, and avoid the most common pitfalls around acl.xml, system.xml bindings and config caching.