diff --git a/lib/api/api.js b/lib/api/api.js
index 0547ac8d45..c326d0ac56 100644
--- a/lib/api/api.js
+++ b/lib/api/api.js
@@ -162,7 +162,8 @@ const api = {
                         // Any explicit deny rejects the current API call
                         log.trace('authorization denial from Vault');
                         return errors.AccessDenied;
-                    } else if (authResults[i].isAllowed) {
+                    }
+                    if (authResults[i].isAllowed) {
                         // If the action is allowed, the result is not implicit
                         // Deny.
                         isImplicitDeny[authResults[i].action] = false;