+ user restriction token in block descriptor