Да.

Какая душещипательная история с максимальной детализацией

Behavior?

Давно было. Получили бан за то, что на форуме кто-то напостил вот на эти темы.

if the access control part

'access' => [
       'class' => AccessControl::class,
        'rules' => [
              [
                   'allow' => true,
                   'actions' => ['profile', 'account', 'networks', 'disconnect'],
                   'roles' => ['@'],
              ],
              [
                   'allow' => $this->module->accountDelete,
                   'actions' => ['delete'],
                   'roles' => ['@'],
              ],
              [
                   'allow' => true,
                   'actions' => ['confirm'],
                   'roles' => ['?', '@'],
               ],
          ],
          'denyCallback'  => function () {
               $this->messageCallback();
               return $this->goHome();
           },
],

you can create middleware for the router

ok

I think the framework should provide it.

I agree

No, not OK.

I've removed it on purpose...

Why ?

for the session problem with rr ?

No

Because:

1. It is typical to pass parameters to access checks and these data  are available in a handler only.
2. It's easier to review code where it starts with pre-checks.

yes user entity pass from params

Which params?

well, for example, we should check that editor that created a post can modify it

we have a post id