refactor runs for/allowed