Maybe also mention that `deny` overrides `allow` as stated below?