Restricting access to nodes I am new to Drupal and for some time now I am trying to figure out how to control access to nodes.
After figuring out that no module will give me what I want and deciding that I will have to get my hands dirty and write my own.

The problem is that nothing works and in no way I can restrict access to nodes. 

To make things simple I tried blocking everything to anything in any way I found, but it makes absolutely no difference.

function mymodule_node_access_records_alter(&amp;$grants, $node) {
  $grants=array();
}

function mymodule_node_access_records($node) {
  return array();
}

function mymodule_node_access($node, $op, $account) {
  return NODE_ACCESS_DENY;
}


The module is loaded by drupal, it is parsed (I get error messages when something is wrong), I tried clearing the cache, tried loading the module on and off, I disabled OG Access Control (I still have OG field access running).

The OG access modules are working more or less correctly (sometimes they block what you want them to block).

I am probably forgetting about something obvious but I feel like I tried everything.
In the code you are showing there are some mistakes.


If you implement hook_node_access_records_alter(), you don't implement hook_node_access_records() (and viceversa)
If you implement hook_access_records(), then you don't implement hook_node_access() (and vice versa).
If you implement hook_node_access_records(), the other hook that need to implement is hook_node_grants().
Returning an empty array in hook_node_access_records() or setting $grants to an empty array in hook_node_access_records_alter() doesn't mean blocking every users from accessing any node. In fact, the function that invokes hook_node_access_records() and hook_node_access_records_alter() (node_access_acquire_grants()) contains the following code.

$grants = module_invoke_all('node_access_records', $node);

// Let modules alter the grants.
drupal_alter('node_access_records', $grants, $node);

// If no grants are set and the node is published, then use the default grant.
if (empty($grants) &amp;&amp; !empty($node-&gt;status)) {
  $grants[] = array(
    'realm' =&gt; 'all',
    'gid' =&gt; 0,
    'grant_view' =&gt; 1,
    'grant_update' =&gt; 0,
    'grant_delete' =&gt; 0,
  );
}


When $grants is empty, it adds the default grant that allows users to see the nodes (if other conditions are met). 


Even implementing the right hooks, a module is not able to stop every single user from accessing all the nodes, since:


Users with the bypass node access permission can still access any node; this includes the first user created on a Drupal site
When viewing a node that is unpublished, the user who created it can still see it, if that user has the view own unpublished content permission


See the code in node_access(), in particular the following lines.

  if (user_access('bypass node access', $account)) {
    $rights[$account-&gt;uid][$cid][$op] = TRUE;
    return TRUE;
  }
  if (!user_access('access content', $account)) {
    $rights[$account-&gt;uid][$cid][$op] = FALSE;
    return FALSE;
  }

  // We grant access to the node if both of the following conditions are met:
  // - No modules say to deny access.
  // - At least one module says to grant access.
  // If no module specified either allow or deny, we fall back to the
  // node_access table.
  $access = module_invoke_all('node_access', $node, $op, $account);
  if (in_array(NODE_ACCESS_DENY, $access, TRUE)) {
    $rights[$account-&gt;uid][$cid][$op] = FALSE;
    return FALSE;
  }
  elseif (in_array(NODE_ACCESS_ALLOW, $access, TRUE)) {
    $rights[$account-&gt;uid][$cid][$op] = TRUE;
    return TRUE;
  }


Assuming you aren't interested in blocking the access to users with the bypass node access permission, or avoiding that users with the view own unpublished content permission can see their own unpublished nodes, then implementing hook_node_access() is the quicker way to avoid some users can see all the nodes, as long as the nodes aren't shown in a list of nodes, for example a view, or the front page, because in that case hook_node_access() is not even invoked.
Differently, the following code surely works and avoid some users can see every node.

function mymodule_node_access($node, $op, $account) {
  return NODE_ACCESS_DENY;
}


If that code doesn't work, then there is an error in the code of the module your wrote, since:


A single module returning NODE_ACCESS_DENY in hook_node_access() stops users from seeing a node (but remember the permissions part)
Drupal core doesn't use hook_node_access_alter(), so a module cannot alter the value returned from your module, and change that value from NODE_ACCESS_DENY to NODE_ACCESS_ALLOW or NODE_ACCESS_NEUTRAL