check for the deny flag first