all access is denied by default