ACL ma anche no. Che ne dite di...

        function permissions($aroId) {

        $sql = "SELECT DISTINCT alias
            FROM
            (
            SELECT
            user_id.aro_id
            ,(
            SELECT
            case when controler is null then method WHEN master is null then concat(controler,'/',method) else concat(master,'/',controler,'/',method) end as alias
            FROM
            (SELECT id,`alias` as method, (SELECT `alias` FROM acos WHERE id=t.parent_id) as controler, (SELECT `alias` FROM acos WHERE id=(SELECT `parent_id` FROM acos WHERE id=t.parent_id)) as `master` FROM acos t) Aco
            WHERE Aco.id=u.aco_id OR Aco.id=p.aco_id
            ) as name,
            CASE WHEN u.aco_id=0  OR u.aco_id is NULL  THEN p.aco_id  ELSE u.aco_id  END as aco_id,
            CASE WHEN u._create=0 OR u._create is NULL THEN p._create ELSE u._create END as _create,
            CASE WHEN u._read=0   OR u._read is NULL   THEN p._read   ELSE u._read   END as _read,
            CASE WHEN u._update=0 OR u._update is NULL THEN p._update ELSE u._update END as _update,
            CASE WHEN u._delete=0 OR u._delete is NULL THEN p._delete ELSE u._delete END as _delete
            FROM
            (SELECT 'a' as flag,$aroId as aro_id) user_id
            LEFT JOIN
            (
            SELECT 'a' as mark1,aco_id,`_create`,`_read`, `_update`, `_delete` FROM `aros_acos` AS `Permission` LEFT JOIN `aros` AS `Aro` ON (`Permission`.`aro_id` = `Aro`.`id`) LEFT JOIN `acos` AS `Aco` ON (`Permission`.`aco_id` = `Aco`.`id`) WHERE `Permission`.`aro_id` = $aroId  ORDER BY `Aco`.`lft` ) u ON u.mark1=user_id.flag
            LEFT JOIN
            (
            SELECT 'a' as mark2,aco_id,`_create`,`_read`, `_update`, `_delete`  FROM `aros_acos` AS `Permission` LEFT JOIN `aros` AS `Aro` ON (`Permission`.`aro_id` = `Aro`.`id`) LEFT JOIN `acos` AS `Aco` ON (`Permission`.`aco_id` = `Aco`.`id`) WHERE `Permission`.`aro_id` = (
            SELECT id
            FROM aros
            WHERE id=(SELECT parent_id from aros WHERE id=$aroId)
            )
            )p ON p.mark2=user_id.flag
            WHERE u._create=1 OR u._read=1 or u._update=1 or u._delete=1
            OR p._create=1 OR p._read=1 or p._update=1 or p._delete=1
            ) tt
              LEFT JOIN
            (
            SELECT `Aco`.`id` , `Aco`.`parent_id` , `Aco`.`model` , `Aco`.`foreign_key` , `Aco`.rght,`Aco`.lft,
            case when controler is null then method WHEN master is null then concat(controler,'/',method) else concat(master,'/',controler,'/',method) end as alias
            FROM
            (SELECT *, `alias` as method, (SELECT `alias` FROM acos WHERE id=t.parent_id) as controler, (SELECT `alias` FROM acos WHERE id=(SELECT `parent_id` FROM acos WHERE id=t.parent_id)) as `master` FROM acos t) Aco
            ) tmp_aco
            ON tmp_aco.id=tt.aco_id OR tmp_aco.alias like concat(tt.name,'%')
        ";

        $permissions = $this->User->query($sql);
        $permissions = Set::extract('/tmp_aco/alias', $permissions);
        return $permissions;
        }