removed check for "allowed" in record to return deny/allow (following the "removed deny access" commit)