Restrictions define which users are allowed to perform a public self-service. These restrictions are checked in the configured order and after the first restriction disallows public self-service, no further checks are performed.

Security Warning: We recommend to use at least the restrictions provided by the "Default Password Reset Restrictions". Omitting these restrictions may allow public self-service for unauthorized (e.g. locked or invalid) users. The "Nonexistent User Restriction" is probably always needed and should be the first restriction in the list.