Migrating from access control to shield / Make deny the default