An empty set of grants is valid: every call is denied with no_grant.