use (self) rather than any as the destination for the lockout rules