Direct Access to Model or to use Library?

[eluser]WebsiteDuck[/eluser]
I wouldn't pull data from the session in the model, more because of coding style than security. You're probably going to use data from the session either way.

I don't think separating user/admin methods into different model files would make you any more secure, so that would be a personal preference. The security would depend on your controllers. If a user is able to spoof that they're an admin, it won't matter where the methods are.