Put RBAC, in the rules prescribed for the rules of specific rules. It does not allow in Gii, and it is logical, because for him I did not specify the rules, if I set up access to some controller like this:
'debug/default' => [ [ 'actions' => [], 'allow' => true, ], ], How can I get something Gii to open access?