understanding allow and deny