The following is taken from app/app_controller.php from webdevelopment2.com's example code: 
http://www.webdevelopment2.com/index.php?dl_id=1

/**
 * Ensure user is authorized.
 *
 * In its purest form, this function MUST be present and return true. It works sort of like a prevalidation for additional criteria. 
 * I've done a little extra to make sure the user with admin routing is the admin:
 * If using admin route, ensure user is admin (group_id ==1). If not, don't authorize.
 * @access public
 */
	function isAuthorized() {
		if (isset($this->params[Configure::read('Routing.admin')])) {
			//  Usage: $this->Auth->user('field_in_user_model');
			if ($this->Auth->user('group_id') != 1) {
				return false;
			}
		}
		return true;
   }
}