There is a --restricted flag to counter the --unrestricted flag. It was documented, but the usage example had missed it. Add it for completeness. Change-Id: Ib4cdcacdd16bfb59e9d18714106ecda99e418812