explicit allow and deny overrides. man, this code is ugly. need refactoring