diff --git a/examples/hello/hello_test.go b/examples/hello/hello_test.go
index bd5a04b..57c54a9 100644
--- a/examples/hello/hello_test.go
+++ b/examples/hello/hello_test.go
@@ -99,7 +99,7 @@
 	mt := fmt.Sprintf("%s=%s", envvar.NamespacePrefix, mounttabled.ExpectVar("NAME"))
 	agentdbin.WithEnv(creds["proxyd"], mt).Start(proxydbin.Path(),
 		"--name", proxyname, "--v23.tcp.address", "127.0.0.1:0",
-		"--access-list", "{\"In\":[\"root/*\"]}")
+		"--access-list", "{\"In\":[\"root\"]}")
 	server := agentdbin.WithEnv(creds["helloserver"], mt).Start(serverbin.Path(),
 		"--name", name, "--v23.proxy", proxyname, "--v23.tcp.address", "")
 	// Prove that we're listening on a proxy.
diff --git a/profiles/internal/rpc/stream/proxy/proxy.go b/profiles/internal/rpc/stream/proxy/proxy.go
index 9cf4d92..414b759 100644
--- a/profiles/internal/rpc/stream/proxy/proxy.go
+++ b/profiles/internal/rpc/stream/proxy/proxy.go
@@ -391,7 +391,7 @@
 func (p *Proxy) authorize(vc *vc.VC, request Request) error {
 	var dmap map[string]security.Discharge
 	if len(request.Discharges) > 0 {
-		dmap := make(map[string]security.Discharge)
+		dmap = make(map[string]security.Discharge)
 		for _, d := range request.Discharges {
 			dmap[d.ID()] = d
 		}