1# Applying Constraints for System Accounts 2 3<!--Kit: Basic Services Kit--> 4<!--Subsystem: Account--> 5<!--Owner: @steven-q--> 6<!--Designer: @JiDong-CS1--> 7<!--Tester: @zhaimengchao--> 8<!--Adviser: @zengyawen--> 9 10The **account** module provides a role-based access control mechanism. You can set constraints for system accounts to restrict their behaviors. 11 12## Constraints 13 14For details about the predefined account constraints, see [Constraints](../../reference/apis-basic-services-kit/js-apis-osAccount.md#constraints). 15 16## Before You Start 17 181. Request the ohos.permission.MANAGE_LOCAL_ACCOUNTS permission. For details, see [Requesting Permissions for system_basic Applications](../../security/AccessToken/determine-application-mode.md#requesting-permissions-for-system_basic-applications). 19 202. Import the **osAccount** module. 21 22 ```ts 23 import { osAccount } from '@kit.BasicServicesKit'; 24 ``` 25 263. Obtain an **AccountManager** instance. 27 28 ```ts 29 let accountManager = osAccount.getAccountManager(); 30 ``` 31 32## Setting Constraints for a System Account 33 34The user can set constraints to restrict the system account behaviors. For example, the user can enable mobile guardian for children to prevent the kids to use Wi-Fi or install applications. 35 36**Procedure** 37 381. Specify the system account ID and the constraints. 39 40 ```ts 41 let localId: number = 100; 42 let constraint: string[] = [ 'constraint.wifi.set' ]; 43 ``` 44 452. Use [setOsAccountConstraints](../../reference/apis-basic-services-kit/js-apis-osAccount-sys.md#setosaccountconstraints) to enable the constraints for the system account. 46 47 ```ts 48 try { 49 accountManager.setOsAccountConstraints(localId, constraint, true); 50 console.log('setOsAccountConstraints successfully'); 51 } catch (err) { 52 console.error('setOsAccountConstraints failed, error: ' + JSON.stringify(err)); 53 } 54 ``` 55 56## Checking Whether a Constraint Can be Enabled for a System Account 57 58Before a constraint is enabled for a system account, the application needs to check whether the constraint can be enabled. You can use [isOsAccountConstraintEnabled](../../reference/apis-basic-services-kit/js-apis-osAccount-sys.md#isosaccountconstraintenabled11) to implement this operation. 59 60**Procedure** 61 621. Set the system account ID and constraint. 63 64 ```ts 65 let localId: number = 100; 66 let constraint: string = 'constraint.wifi.set'; 67 ``` 68 692. Use [isOsAccountConstraintEnabled](../../reference/apis-basic-services-kit/js-apis-osAccount-sys.md#isosaccountconstraintenabled11) to check whether the constraint can be enabled for the system account. 70 71 ```ts 72 accountManager.isOsAccountConstraintEnabled(localId, constraint).then((isEnabled: boolean) => { 73 if (isEnabled) { 74 // Your business logic 75 } 76 }); 77 ``` 78