app-enforced restrictions