Exemplo:

 array(
        'panel' => array(
            'icon' => 'ion ion-chatboxes',
            'title' => __('Agent Panel'),
            'url' => array(
                'admin' => true,
                'controller' => 'chassi',
                'action' => 'dashboard'
            )
        )
    ),
    'Reports' => array(
        'index' => array(
            'icon' => 'ion ion-grid',
            'title' => sprintf(__('List %s'), __('Reports')),
            'url' => array(
                'admin' => true,
                'controller' => 'reports',
                'action' => 'index'
            )
        ),
        'dashboard' => array(
            'icon' => 'ion ion-easel',
            'title' => __('Report Dashboard'),
            'url' => array(
                'admin' => true,
                'controller' => 'reports',
                'action' => 'dashboard'
            )
        ),
        'add' => array(
            'icon' => 'ion ion-plus-round',
            'title' => sprintf(__('Add %s'), __('Report')),
            'url' => array(
                'admin' => true,
                'controller' => 'reports',
                'action' => 'add'
            )
        ),
    ),
);


$output = $this->Layout->filterUrlsAllowed($urls); 

O Output é um array contendo apenas as urls liberadas para o usuário, configurável através do módulo permissions do Framework. Ex:

array(
	'Agent' => array(
		'panel' => array(
			'icon' => 'ion ion-chatboxes',
			'title' => 'Painel de Agente',
			'url' => array(
				'admin' => true,
				'controller' => 'chassi',
				'action' => 'dashboard'
			)
		)
	),
	'Reports' => array(
		'index' => array(
			'icon' => 'ion ion-grid',
			'title' => 'Listar Relatórios',
			'url' => array(
				'admin' => true,
				'controller' => 'reports',
				'action' => 'index'
			)
		),
	)
);