diff --git a/README.rst b/README.rst
index 536a4d5..23454d9 100644
--- a/README.rst
+++ b/README.rst
@@ -172,6 +172,10 @@
           test_salt_project:
             enabled: true
             access:
+              "refs/*":
+                - name: read
+                  group: Anonymous Users
+                  deny: true
               "refs/heads/*":
                 actions:
                 - name: abandon
diff --git a/gerrit/files/project.config b/gerrit/files/project.config
index 0f1eb57..f7f008e 100644
--- a/gerrit/files/project.config
+++ b/gerrit/files/project.config
@@ -35,7 +35,7 @@
 
 [access "{{ access_name }}"]
 	{%- for action in access.get('actions', []) %}
-	{{ action.name }} = {% if action.get('force', False) %}+force {% endif %}group {{ action.group }}
+	{{ action.name }} = {% if action.get('force', False) %}+force {% endif %}{% if action.get('deny', False) %}deny {% endif %}group {{ action.group }}
 	{%- endfor %}
 	{%- for label in access.get('labels', []) %}
 	label-{{ label.name }} = {{ label.score }} group {{ label.group }}