First place to start is with Joomla, if Joomla does it then you can read the code to see how it's been implemented. The current ACL model was introduced way back in the start of the 2.5 line (aka 1.6)
Joomla breaks down it's ACL functionality into "viewing" and "doing", what you're asking about is viewing.
com_content you can see that the Article view checks the view access in the view class file
ContentViewArticle with the following criteria:
// Check the view access to the article (the model has already computed the values).
if ($item->params->get('access-view') == false && ($item->params->get('show_noauth', '0') == '0'))
You'll note the comment that "the model has already computed the values", in this case the model is
ContentModelArticle found in
/components/com_content/models/article.php. Towards the end of the
getItem() method you will find:
// Compute view access permissions.
if ($access = $this->getState('filter.access'))
// If the access filter has been set, we already know this user can view.
// If no access filter is set, the layout takes some responsibility for display of limited information.
$user = JFactory::getUser();
$groups = $user->getAuthorisedViewLevels();
if ($data->catid == 0 || $data->category_access === null)
$data->params->set('access-view', in_array($data->access, $groups));
$data->params->set('access-view', in_array($data->access, $groups) && in_array($data->category_access, $groups));
Of course, depending on your extension you may have other requirements you need to check against in addition to Joomla's ACL. There's also the very reasonable expectation you want to control what users are "doing".
To get a better idea of the ACL the recommended reading is probably "Access Control List" and "J25: Access Control List Tutorial" on Joomla's Doc's website.