I would put the deny_access to the else block https://github.com/Katello/katello/pull/4085/files#diff-07b774c4986d404dacbf02d82819e0c4R402