1# Applying Constraints for System Accounts 2 3The **account** module provides a role-based access control mechanism. You can set constraints for system accounts to restrict their behaviors. 4 5## Constraints 6 7For details about the predefined account constraints, see [Constraints](../../reference/apis-basic-services-kit/js-apis-osAccount.md#constraints). 8 9## Before You Start 10 111. Request the ohos.permission.MANAGE_LOCAL_ACCOUNTS permission. For details, see [Requesting Permissions for system_basic Applications](../../security/AccessToken/determine-application-mode.md#requesting-permissions-for-system_basic-applications). 12 132. Import the **osAccount** module. 14 15 ```ts 16 import { osAccount } from '@kit.BasicServicesKit'; 17 ``` 18 193. Obtain an **AccountManager** instance. 20 21 ```ts 22 let accountManager = osAccount.getAccountManager(); 23 ``` 24 25## Setting Constraints for a System Account 26 27The user can set constraints to restrict the system account behaviors. For example, the user can enable mobile guardian for children to prevent the kids to use Wi-Fi or install applications. 28 29**Procedure** 30 311. Specify the system account ID and the constraints. 32 33 ```ts 34 let localId: number = 100; 35 let constraint: string[] = [ 'constraint.wifi.set' ]; 36 ``` 37 382. Use [setOsAccountConstraints](../../reference/apis-basic-services-kit/js-apis-osAccount-sys.md#setosaccountconstraints) to enable the constraints for the system account. 39 40 ```ts 41 try { 42 accountManager.setOsAccountConstraints(localId, constraint, true); 43 console.log('setOsAccountConstraints successfully'); 44 } catch (err) { 45 console.log('setOsAccountConstraints failed, error: ' + JSON.stringify(err)); 46 } 47 ``` 48 49## Checking Whether a Constraint Can be Enabled for a System Account 50 51Before a constraint is enabled for a system account, the application needs to check whether the constraint can be enabled. 52You can use [isOsAccountConstraintEnabled](../../reference/apis-basic-services-kit/js-apis-osAccount-sys.md#isosaccountconstraintenabled11) to implement this operation. 53 54**Procedure** 55 561. Set the system account ID and constraint. 57 58 ```ts 59 let localId: number = 100; 60 let constraint: string = 'constraint.wifi.set'; 61 ``` 62 632. Use [isOsAccountConstraintEnabled](../../reference/apis-basic-services-kit/js-apis-osAccount-sys.md#isosaccountconstraintenabled11) to check whether the constraint can be enabled for the system account. 64 65 ```ts 66 let isEnabled: boolean = await accountManager.isOsAccountConstraintEnabled(localId, constraint); 67 if (isEnabled) { 68 // Your business logic 69 } 70 ``` 71