new access plugin to deny if entitylist is empty.