If we want to deny everything that is not known, (POLICY_DENY) then isGranted must return false. What's the problem?