config controller restrictions