if not authorized deny data access