When there is a clear deny, the error message says "no modules active". That should be cleaned up as well as specify what security domain it is.