MACROMEDIA COLDFUSION MX 61-DEVELOPING COLDFUSION MX Develop Manual page 249

Using role-based security
If you specify a attribute in a tag, as the following example shows, only users
roles cffunction
who are logged in with one of the specified roles can execute the function:
<cffunction name="foo" roles="admin,moderator">
When a user tries to invoke a method that he or she is not authorized to invoke, an exception is
returned.
For information on ColdFusion security, including the tag and role-based security in
cflogin
ColdFusion MX, see Chapter 16, "Securing Applications," on page 345.
Building ColdFusion components 249