restrict access to @restraint/@rlv (managers only)