Don't optimize around denied org roles.

If that isn't a common case, it'll lead to more SQL queries.