Add comment about lack of allow/deny rules for upserts