implement ::allowed_from_hash?