Manual:Hooks/getUserPermissionsErrors/pl

Details

 * $title - Title object being checked against
 * $user - Current user object
 * $action - Action being checked
 * &$result - User permissions error to add. If none, return true. $result can be returned as a single error message key (string), or an array of error message keys when multiple messages are needed (although it seems to take an array as one message key with parameters?).

Differences from
Both hooks are typically run when checking for proper permissions in. When it is desirable to skip potentially expensive cascading permission checks, only getUserPermissionsErrors is run. This behavior is suitable for nonessential UI controls in common cases, but not for functional access control. This behavior may provide false positives, but should never provide a false negative.