extra AuthorizationRule in web.config AuthorizationSection

Question

I'm trying to modify the list of allowed users in web.config from a codebehind.

<authorization>
   <allow users="alice, bob"/>
   <deny users="*"/>
</authorization>

I successfully retrieve the section I need

  config = WebConfigurationManager.OpenWebConfiguration("~");
  authSection = (AuthorizationSection)config.GetSection("system.web/authorization");

When I iterate looking for the allow rule, I get two of them.

 foreach (AuthorizationRule rule in authSection.Rules)
 {
     if (rule.Action == AuthorizationRuleAction.Allow)
     {
          // manage the Users StringCollection
      }
  }

The first item I get has 'alice' and 'bob' in the Users collection. The SECOND item I get has * Where is this second entry coming from? This is an Allow Rule, not a Deny rule. I could understand the * from a Deny rule. Is there some extra inheritance I'm not aware of?