Add "allow" object handling for permission checks