Run denies before allows