deny by default and trust only people that need to know