make sure a user cant deny unknown users access to an object