changed allow to grant
added canAny, canAll