refactor tests to use allow/deny rules efficiently