Help only says "Best practice: Use Access Manager to deny authorization instead of working directly with the fields in this tab." My original question was not about Access Manager but in ARO instance how exactly can I specify Access When. Are both Access When and Access Deny supposed to be shown in the dropdown in ARO rule? To me it looks like Pega only displays Access When rule instance but not Access Deny. Hope this clarifies my original question.