diff --git a/db/delete.go b/db/delete.go
index 5be55ff0..86164873 100644
--- a/db/delete.go
+++ b/db/delete.go
@@ -77,11 +77,11 @@ func executeDeleteStatement(txn kvs.TX, ast *sql.DeleteStatement) (out []interfa
 
 func delete(doc *item.Doc, ast *sql.DeleteStatement) (out interface{}, err error) {
 
-	if !doc.Allow("DELETE") {
+	if !doc.Check(ast.Cond) {
 		return
 	}
 
-	if !doc.Check(ast.Cond) {
+	if !doc.Allow("DELETE") {
 		return
 	}
 
diff --git a/db/modify.go b/db/modify.go
index 5ccf0792..9e6ed5c4 100644
--- a/db/modify.go
+++ b/db/modify.go
@@ -77,10 +77,6 @@ func executeModifyStatement(txn kvs.TX, ast *sql.ModifyStatement) (out []interfa
 
 func modify(doc *item.Doc, ast *sql.ModifyStatement) (out interface{}, err error) {
 
-	if !doc.Allow("UPDATE") {
-		return
-	}
-
 	if !doc.Check(ast.Cond) {
 		return
 	}
@@ -89,6 +85,10 @@ func modify(doc *item.Doc, ast *sql.ModifyStatement) (out interface{}, err error
 		return
 	}
 
+	if !doc.Allow("UPDATE") {
+		return
+	}
+
 	if err = doc.StoreIndex(); err != nil {
 		return
 	}
diff --git a/db/select.go b/db/select.go
index ba435b39..9db73790 100644
--- a/db/select.go
+++ b/db/select.go
@@ -70,14 +70,14 @@ func executeSelectStatement(txn kvs.TX, ast *sql.SelectStatement) (out []interfa
 
 func detect(doc *item.Doc, ast *sql.SelectStatement) (out interface{}, err error) {
 
-	if !doc.Allow("SELECT") {
-		return nil, nil
-	}
-
 	if !doc.Check(ast.Cond) {
 		return
 	}
 
+	if !doc.Allow("SELECT") {
+		return nil, nil
+	}
+
 	out = doc.Blaze(ast)
 
 	return
diff --git a/db/update.go b/db/update.go
index a600099c..33b2b301 100644
--- a/db/update.go
+++ b/db/update.go
@@ -77,10 +77,6 @@ func executeUpdateStatement(txn kvs.TX, ast *sql.UpdateStatement) (out []interfa
 
 func update(doc *item.Doc, ast *sql.UpdateStatement) (out interface{}, err error) {
 
-	if !doc.Allow("UPDATE") {
-		return
-	}
-
 	if !doc.Check(ast.Cond) {
 		return
 	}
@@ -89,6 +85,10 @@ func update(doc *item.Doc, ast *sql.UpdateStatement) (out interface{}, err error
 		return
 	}
 
+	if !doc.Allow("UPDATE") {
+		return
+	}
+
 	if err = doc.StoreIndex(); err != nil {
 		return
 	}
diff --git a/util/item/allow.go b/util/item/allow.go
index fac2022f..ed1587fa 100644
--- a/util/item/allow.go
+++ b/util/item/allow.go
@@ -35,7 +35,8 @@ func (this *Doc) Allow(cond string) (val bool) {
 
 				vm := otto.New()
 
-				vm.Set("doc", this.current.Copy())
+				vm.Set("data", this.initial.Copy())
+				vm.Set("edit", this.current.Copy())
 
 				ret, err := vm.Run("(function() { " + rule.Code + " })()")
 				if err != nil {
@@ -56,7 +57,8 @@ func (this *Doc) Allow(cond string) (val bool) {
 				vm := lua.NewState()
 				defer vm.Close()
 
-				vm.SetGlobal("doc", toLUA(vm, this.current.Copy()))
+				vm.SetGlobal("data", toLUA(vm, this.initial.Copy()))
+				vm.SetGlobal("edit", toLUA(vm, this.current.Copy()))
 
 				if err := vm.DoString(rule.Code); err != nil {
 					return false