Did you mean to say don't use a default deny?