Why not?

I disallow them in stuff in the domain-wide AC config, because that stuff needs to be consistent across all process in the domain for domain execution to work properly. But that's not an issue here.