New rules model: accept/reject instead of allow/deny; thanks to @mutantcornholio
More unit-test proves this saint naive is right