The url mapping isn't going to be useful to you then :-)

Yes, I would suggest mapping role-lists against actions. If you do that in the database or whatever storage system you use, or use a consisten interface in your action classes, you can still do a generic access control system after request to action mapping and before dispatching to the action.