diff --git a/internal/service/access_controls_rules.go b/internal/service/access_controls_rules.go
index 318894d2..b8c805a8 100644
--- a/internal/service/access_controls_rules.go
+++ b/internal/service/access_controls_rules.go
@@ -69,7 +69,6 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
 			rule.Log.App.Debug().Str("username", ctx.UserContext.GetUsername()).Msg("User is in users block list, denying access")
 			return EffectDeny
 		}
-		return EffectAllow
 	}
 
 	rule.Log.App.Debug().Msg("Checking users allow list")
@@ -78,6 +77,9 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
 
 	if err != nil {
 		if errors.Is(err, utils.ErrFilterEmpty) {
+			if ctx.ACLs.Users.Block != "" {
+				return EffectAllow
+			}
 			return EffectAbstain
 		}
 		rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.GetUsername()).Msg("Invalid entry in users allow list")
diff --git a/internal/service/access_controls_rules_test.go b/internal/service/access_controls_rules_test.go
index 7cb0f8ba..97f4b0f6 100644
--- a/internal/service/access_controls_rules_test.go
+++ b/internal/service/access_controls_rules_test.go
@@ -137,6 +137,51 @@ func TestUserAllowedRule(t *testing.T) {
 			},
 			expected: EffectAllow,
 		},
+		{
+			name: "allows local user when username matches allow list and not block list",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Users: model.AppUsers{Allow: "alice,bob", Block: "bob"},
+				},
+				UserContext: &model.UserContext{
+					Provider: model.ProviderLocal,
+					Local: &model.LocalContext{
+						BaseContext: model.BaseContext{Username: "alice"},
+					},
+				},
+			},
+			expected: EffectAllow,
+		},
+		{
+			name: "denies local user when username matches allow and block lists",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Users: model.AppUsers{Allow: "alice,bob", Block: "bob"},
+				},
+				UserContext: &model.UserContext{
+					Provider: model.ProviderLocal,
+					Local: &model.LocalContext{
+						BaseContext: model.BaseContext{Username: "bob"},
+					},
+				},
+			},
+			expected: EffectDeny,
+		},
+		{
+			name: "denies local user when username matches neither allow nor block list",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					Users: model.AppUsers{Allow: "alice,bob", Block: "bob"},
+				},
+				UserContext: &model.UserContext{
+					Provider: model.ProviderLocal,
+					Local: &model.LocalContext{
+						BaseContext: model.BaseContext{Username: "charlie"},
+					},
+				},
+			},
+			expected: EffectDeny,
+		},
 		{
 			name: "denies when block list filter is invalid",
 			ctx: &ACLContext{