moved allow-deny operations to secure place