What I have is heaps of seperate and distinct applications, each application is self contained, ie an application for "moving house" (i work for an ISP) and an application for managing IP's. As you can appreciate these are very distinct modules.

What makes them part of a single user interface is session management and access control, which is done centrally. The structure we use is a layer on top of C:A that handles the session management and access control that has use base CGI::Application in it (lets call this module "control")

Whenever a new application is coded we need to add a use base Control; to it, and there you have it, implicit session management and access control.

All the business logic is mapped out at this level. All the external access (to DB's, sockets etc) is abstracted away from this into seperate modules which any application can access.

Experience thus far with this type of design has shown it can scale quite well (we use an RDBMS for access control and session management).