allow-deny for client updates