How to unit test authorization globally in CakePHP

We're using CakePHP v3.1.x with the CakeDC Users plugin.

We're trying to set up our unit tests to help prevent accidentally allowing non-admins to do things they should not be allowed to do. For example, imaging a developer creates a new admin feature with a new action in a controller. During development she sets the permissions very lax so she doesn't have to log in each time to test it (or something... you get the idea). I'm trying to write a test that will fail if she tries to push this...

Here's my idea for how to do it:

• Create a test that loops over all controllers / actions in the app, and checks to see if a non-admin user is authorized.
• The test has a list of every action that a non-admin user can do.
• The test fails if a non-admin is allowed to do anything that's not on the list.

The idea is that every time we intentionally let non-admin users do something, the test fails, and reminds us to go update the list of exceptions. But if we accidentally allow an action without knowing it, the test fails and we fix the mistake. It's a safety catch.

My question: Is this the right way to do this? And if so, how can we dynamically generate a list of all of the apps controllers/actions?