diff --git a/bearer/bearer.go b/bearer/bearer.go
index 39ef0fa..fc4d0a3 100644
--- a/bearer/bearer.go
+++ b/bearer/bearer.go
@@ -63,6 +63,11 @@ func (b *Generator) NewBearer(email string, currentEpoch uint64, msPerEpoch int6
 	eacl.AddFormedTarget(rec2, eacl.RoleOthers)
 	t.AddRecord(rec2)
 
+	rec3 := eacl.CreateRecord(eacl.ActionDeny, eacl.OperationPut)
+	rec3.AddFilter(eacl.HeaderFromObject, eacl.MatchNotPresent, object.AttributeContentType, "")
+	t.AddRecord(rec3)
+	eacl.AddFormedTarget(rec3, eacl.RoleOthers)
+
 	var bt bearer.Token
 	bt.SetEACLTable(*t)
 	if b.config.UserID != nil {