refactored isAllowed into canRead and canWrite