further improvement of allow and deny rules