lock down the approval list