Denials not reported in enforcing mode