With the addition of #809 , we need to change the default behavior, in order to have more strict access. In a nutshell, when type=='address': - for allow rules: if value does not exist or it's empty -> no one has access. if value list has at least one element, check it - for deny rules: if value does not exist or it's empty -> there is no deny list. if value list has at least one element, check it