It took me some time to understand that passing undef works in %def.

That's when I updated my reply ...

But naming it %allowed would be much clearer.

> I don't mind hand coding a solution for the 1 in 1000 case, if that means the other 999 cases operate in an efficient manner.

I agree, but I think I'm closer to 999 than you are! :)