class StudentController extends Controller
{
	//custom function
	public function accessCriteria()
	{
		$criteria = new CDbCriteria();
		if (!Yii::app()->user->isSuperuser) {
			$criteria->condition = 'branch_id=:bid';
			$criteria->params = [':bid'=>Yii::app()->user->id];
		}
		
		return $criteria;
	}

	//in update method:
	public function actionUpdate($id) {
		$student = Student::model()->findByPk($id, $this->accessCriteria());
		// then your code
	}

}