Handle missing entities properly in *-allowed?

If the programme_id and project_id can't be found then the entity
doesn't exist so returning true as anyone can do things to something
that doesn't exist. Other methods will return how the missing resource
should be handled.