Most systems will want to restrict some menu items to particular users. We probably should have a hard dependency on the authentication-with-roles scaffold, however we do need to allow some way for integrating these two modules.
Perhaps we need a SecurityProvider interface which provides a method "IsPermitted( $permissionRequired )" and then a module can register an appropriate provider for security testing?