block-all narrowly-allow-all (using temporary scopes)