restrict environment