allow-revoked: no