add canAccess and pathological Disallow case