A _guard.php in a directory decides, for every page below it, whether the request may see the page - before any _inits.php or page PHP runs. Access control follows the file tree: put one in admin/ and every page there is protected, with no list of routes to keep in step.

The guard of this manual's guarded/ directory:

<?php

  // The pages in this directory open only to a request that says ?pass=yes.

  return padRequest ( 'pass' ) === 'yes';

?>

• Returning FALSE - or anything that is not true: NULL, 0, '' - refuses the page with 403 Forbidden. Returning TRUE, or no return at all, lets the request through to the next guard down.
• The guards run from the application root down, each directory's in turn, after the _lib files, so a guard can call the application's functions and read the session and request variables - and $padPage, to decide per page.
• A guard can send the visitor elsewhere itself: padRedirect ( 'login' ).
• A page a {page} tag includes is guarded too: when its guard says no, it renders as nothing, and the page that includes it carries on.
• A guarded page is never served from the page cache, nor stored in it.

This request did not say ?pass=yes, so the included page stays empty:

<p>Included: [{page 'guarded/secret'}]</p>