Better approach to restricting users access to managed controllers?

[eluser]skunkbad[/eluser]
I give them the login page. You never know if they have a second account that will give them the appropriate permissions. It probably depends on the nature of the website. There are some websites that I have like 10 accounts on. There are others, such as a bank, where having more than one account is unlikely. Even then, what if the user is a customer, and also an employee, and has two accounts? IDK...