You probably just haven't done it yet, but it would be good to factor out these `denyInsert` and `denyUpdate` checks because you'll also have to run them just prior to the actual insert or update calls in `_insertOrUpdate()`.