access-controlcapabilitiesrestrict