diff --git a/internal/service/access_controls_rules.go b/internal/service/access_controls_rules.go
index 318894d2..b8c805a8 100644
--- a/internal/service/access_controls_rules.go
+++ b/internal/service/access_controls_rules.go
@@ -69,7 +69,6 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
 			rule.Log.App.Debug().Str("username", ctx.UserContext.GetUsername()).Msg("User is in users block list, denying access")
 			return EffectDeny
 		}
-		return EffectAllow
 	}
 
 	rule.Log.App.Debug().Msg("Checking users allow list")
@@ -78,6 +77,9 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
 
 	if err != nil {
 		if errors.Is(err, utils.ErrFilterEmpty) {
+			if ctx.ACLs.Users.Block != "" {
+				return EffectAllow
+			}
 			return EffectAbstain
 		}
 		rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.GetUsername()).Msg("Invalid entry in users allow list")
diff --git a/internal/service/access_controls_rules_test.go b/internal/service/access_controls_rules_test.go
index 7cb0f8ba..3394f0bd 100644
--- a/internal/service/access_controls_rules_test.go
+++ b/internal/service/access_controls_rules_test.go
@@ -212,6 +212,66 @@ func TestUserAllowedRule(t *testing.T) {
 			},
 			expected: EffectDeny,
 		},
+		{
+			name: "denies user when both block and allow configured and user in block list",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Users: model.AppUsers{Block: "evil", Allow: "alice,bob"},
+				},
+				UserContext: &model.UserContext{
+					Provider: model.ProviderLocal,
+					Local: &model.LocalContext{
+						BaseContext: model.BaseContext{Username: "evil"},
+					},
+				},
+			},
+			expected: EffectDeny,
+		},
+		{
+			name: "allows user when both block and allow configured and user in allow list",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Users: model.AppUsers{Block: "evil", Allow: "alice,bob"},
+				},
+				UserContext: &model.UserContext{
+					Provider: model.ProviderLocal,
+					Local: &model.LocalContext{
+						BaseContext: model.BaseContext{Username: "alice"},
+					},
+				},
+			},
+			expected: EffectAllow,
+		},
+		{
+			name: "denies user when both block and allow configured and user in neither",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Users: model.AppUsers{Block: "evil", Allow: "alice,bob"},
+				},
+				UserContext: &model.UserContext{
+					Provider: model.ProviderLocal,
+					Local: &model.LocalContext{
+						BaseContext: model.BaseContext{Username: "charlie"},
+					},
+				},
+			},
+			expected: EffectDeny,
+		},
+		{
+			name: "denies user when both block and allow match same user",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Users: model.AppUsers{Block: "alice", Allow: "alice,bob"},
+				},
+				UserContext: &model.UserContext{
+					Provider: model.ProviderLocal,
+					Local: &model.LocalContext{
+						BaseContext: model.BaseContext{Username: "alice"},
+					},
+				},
+			},
+			expected: EffectDeny,
+		},
 	}
 
 	for _, tt := range tests {