updating permissions checking to default to deny