If permission is missing, default to allow, not deny.