gistfile1.txt

diff --git a/vapn.module b/vapn.module
index ffcc861..35bb5ce 100644
--- a/vapn.module
+++ b/vapn.module
@@ -70,6 +70,12 @@ function vapn_node_access(NodeInterface $entity, $operation, AccountInterface $a
       $rid = $item->target_id;
       $allowed_roles[$rid] = $rid;
     }
+
+    // Nothing marked on a node? Allow by default.
+    if (empty($allowed_roles)) {
+      return AccessResult::neutral();
+    }
+
     $access_result = array_intersect($account->getRoles(), $allowed_roles)
       ? AccessResult::allowed()
       : AccessResult::forbidden();