(I am experiencing a bug in the latest version of Zend that seems similar to an issue reported in the past - ZF-5425. It is the same in every way except I am only having trouble with the "privilege" parameter. Everything else seems to be being passed.)

Zend_Acl manual states that:

{quote} The assert() method of an assertion object is passed the ACL, role, resource, and privilege to which the authorization query (i.e., isAllowed()) applies, in order to provide a context for the assertion class to determine its conditions where needed. {quote}

But when assertion is attached to global "all-privileges" with:

$acl::allow('someRole',null,null,new MyAssertion());

... with the assertion built like:

class MyAssertion implements Zend_Acl_Assert_Interface {
    public function assert(Zend_Acl $acl,
                Zend_Acl_Role_Interface $role = null,
                Zend_Acl_Resource_Interface $resource = null,
                $privilege = null)
    {
        if($role == 'someRole') return true;
        elseif($resource == 'someBannedResource') return false;        
        else return true;
    }   
}

... Then after a query:

 $acl->isAllowed('someRole','someResource','somePermission');

... the assertion should be called with

{{assert(Zend_Acl object, 'somerole', 'someResource', 'somePermission')}}.

Instead it is called with

{{assert(Zend_Acl object, 'somerole', 'someResource', null)}}