Cannot block access to nodes with hook_node_access_records I have written a module which adds a node access record. The workflow module is also installed which adds two other records to the node_access table. 

Here Author says that:


  Drupal is a “deny-based” access control system. In other words, if
  anybody denies access to a node, then the node is blocked.


But when I deny access to a node in my module, it is still accessible for all users.(workflow module grants access for both anonymous and registered users)

A solution would be setting the record priority higher than workflow's access records, but I don't want to change the priorities.

/**
 * Implements hook_node_access_records()
 */
function mymodule_node_access_records($node) {

   $user = field_get_items('node', $node, 'field_recipient');
   $uid = $user[0]['uid'];


   if ($node-&gt;type == 'contact') {
      $grants[] = array(
         'realm' =&gt; 'contact',
         'gid' =&gt; $uid,
         'grant_view' =&gt; 1,
         'grant_update' =&gt; 0,
         'grant_delete' =&gt; 0,
         'priority' =&gt; 0,
      );
   }
   return $grants;
}

/**
 * Implements hook_node_grants()
 */
function mymodule_node_grants($account, $op) {
   $grants['contact'] = array(1234); //1234 is for test and doesn't exists in node_access table
   return $grants;
}


Is anything wrong?
Blog post needs to be updated. I remember having discussion with him about it.

hook_node_access is a deny access; grants are if a user has any matching grant, they have access.

you can use the alter hook to remove undesirable grants, but doing custom access requires a lot of testing and thinking. Also, read the https://api.drupal.org/api/drupal/modules%21node%21node.module/function/node_access/7 node_access documentation/code