controllers.groovy

def controllerFunction() {
	def user = User.get(params.userId)
	if (!userPermissionService.hasPermissionToDoThis(user) {
		response.status = 403
		render "User unauthorized"
		return 
	}
	def comments = commentsService.getByUser(user) 
	...
	
	render finalObject as JSON		
 }