ACL Simulator

Admin → ACL Simulator (superadmin). The answer to "why am I locked out?"

Pick a role, a resource (a controller or service class), and an optional privilege (action/method), then Explain. The tool runs the live ACL and shows:

• the verdict — allowed or denied;
• the reason — the deciding rule (even when it's inherited from a parent role), or deny-by-default when nothing grants access;
• the role inheritance chain it walked.

It's read-only — it never changes policy, so it's safe to poke at. Use it to answer "would a manager be able to reach this service?" by asking the ACL, instead of reading .ini files.

For the concepts behind the answer — deny-by-default, roles-on-membership, grants as data — see Authorization.