It's ascx permisssions - you are explicitly deciding who can access your controls. The normal development mechanism is to have a primary ascx (usually named what your module is doing e.g. mywidget.ascx). This then set's up access to the other related ascx's in the ModuleActions property e.g in this example below mywiget.ascx add's a menu item for 'add content' but makes it only accessible to user's with edit permissions).
Public ReadOnly Property ModuleActions() As Entities.Modules.Actions.ModuleActionCollection Implements Entities.Modules.IActionable.ModuleActions
Get
Dim Actions As New Entities.Modules.Actions.ModuleActionCollection
Actions.Add(GetNextActionID, Localization.GetString(Entities.Modules.Actions.ModuleActionType.AddContent, LocalResourceFile), Entities.Modules.Actions.ModuleActionType.AddContent, "", "", EditUrl(), False, Security.SecurityAccessLevel.Edit, True, False)
Return Actions
End Get
End Property