 <p>Well I believe the <a href="https://github.com/strongloop/loopback/blob/v2.34.1/common/models/user.json#L37-L96" rel="nofollow">default user acls</a> are still working and they are not overrided. The way loopback decides which ACL entry is effective for the request, is by selecting most specific one that appears later. So loopback has defined this entry:</p> <pre><code>{ "principalType": "ROLE", "principalId": "$everyone", "permission": "ALLOW", "property": "login" } </code></pre> <p>Since it's as specific as it gets, to beat that you have to add this in your model:</p> <pre><code>{ "principalType": "ROLE", "principalId": "$everyone", "permission": "DENY", "property": "login" } </code></pre> <p>There's also another way to remove the default user acls via code but it's not documented.</p>