The current [3.1 upgrading notes](http://doc.silverstripe.org/framework/en/3.1/changelogs/3.1.0#deny-url-access-if-controller-allowed-actions-is-undefined-or-empty-array) says that undefined and empty $allowed_actions cause all actions to be denied.