correct scope checking in AccessTone.restrict