Okay, that makes more sense. I still think that's not related to user access control. The access control is something that a shared piece of code would do, be it invoked by your single uber-CGI, or by a bunch of separate CGI::Application scripts, or something totally different. It's orthogonal to your choice about how to organize the actions available on your site.