outbound: replace DENY/OK with constants.ok|deny