Bit of refactoring (different ACLs for allowed and denied)