constraint: spec test for the new allow/forbid params syntax