it is to make sure allowed is boolean. because of the permissions object format (only resources with read and/or write == true is in object), allowed can be undefined at this point.