so the expression should be string but it cannot be string, that's why it is not working, am I right?
The docs say it must be a string, but the internal workings of yii 1.0.3 treat accessRules' expression filter as an array. This has been fixed in the trunk, just check out the latest code from the repo.