`allow` not a whitelist