Access is by allowlist: an account with no active user row is refused.