If you prefer filters() and isAllowed(), I'm OK with that. As for why, mostly I just prefer to support descriptive programming, rather than making everyone write their own similar logic in allow/deny. 90% of the time people will be checking type, extension, or file size, so it should be as simple as possible. Just my opinion. Also, like you said, it seems better to separate security from general filtering.