so it's "deny all, then allow some, then deny some"?