The functionality around public, protected and private methods in a controller seems a little weird to me...

Love that methods are available to urls /home/method, however think that only public functions should be, currently protected also work, and the controller thinks that private ones exist and tries and then fails with an error:
Uncaught Exception: Object->__call(): the method 'yo3' does not exist on 'Page_Controller'

public function yo1() {
	return $this;
}

protected function yo2() {
	return $this;
}

private function yo3() {
	return $this;
}

Love that methods are available to templates and love that only public or protected methods are, however private functions fail with the same error as above.

Surely in both cases private functions should fail the same way as calling a method that does exist (url=404, template=no output).

Secondly it seems that $allowed_actions is some remedy here, however if there is documentation for this I can't find it (aside from what's in code). Doesn't help that documentation search ignores underscores and treats it as a space. So you might as well just have searched "allowed actions".

Allowed actions is the way to go here rather than private methods.

static $allowed_actions = array('yo1', 'yo2');