To Check URL is authorized or not to the user

    private function _registerSession(Users $user)

    {
        $this->session->set('auth', array(
            'role' => $user->role
        ));
    }

 $userInfo = $this->session->get("auth");

                     if(!$userInfo) {

          $data  = [

                  "users" => ["status" => 0,  "error" => ["type" => "session"]]];

                   //echo json_encode($data);

                   $this->response->redirect("login");

          } 

          if($userInfo['role'] == 'admin') { 

                 //logic
          } elseif($userInfo['role'] == 'Manager') {

                //logic
          } else {

                //Guest logic 
          }

There are really a lot of components that you have requested in this question so i am going to direct you to the demo app that shows all fo these functions.

The Vokuro sample app from phalcon will show you a lot of the functionality you are looking for.

https://github.com/phalcon/vokuro

It uses an Auth library for authorizing users. Each user has a Porfile with their own personal settings profiles (ACL).

then run everything through a base controller. First see if they have access to the controller.

then once they make it through that you can set up your other settings. the example above shows this last step for hte most part.

The phalcon ACL (Access Controll Layer) to control whether or not a user can do things.

You can use the ACL for more than just controller controll as they do in the demo app. You can set an arbitrary number of permissions on each controller.

In phalcon 2.1.x i added some functionallity to ACL, to extend it with custom logic, you can add some functions which will return true/false when checking isAllowed method. Also it can operate now on objects. Check 2.1.x branch. If you need documentation you can also check docs repo in master branch on phalcon cuz i wrote about it too.