For example, if the client tries to send a `tool` header with a value of `plumbus`, they will receive an **error** response telling them that the header parameter `tool` is not allowed:

```json
{
    "detail": [
        {
            "type": "extra_forbidden",
            "loc": ["header", "tool"],
            "msg": "Extra inputs are not permitted",
            "input": "plumbus",

import java.util.Iterator;
import org.checkerframework.checker.nullness.qual.NonNull;
import org.checkerframework.checker.nullness.qual.Nullable;

/**
 * A simplistic collection which implements only the bare minimum allowed by the spec, and throws
 * exceptions whenever it can.
 *
 * @author Kevin Bourrillion
 */
@GwtCompatible
@ElementTypesAreNonnullByDefault

| Params        | Value                                          |
| :--           | :--                                            |

> Without a 'Complete' status any 'Active' or 'Draining' pool(s) are not allowed to be removed once configured.

## NOTE

	// only two elements allowed in the string - "scheme" and "number of parity drives"
	if len(s) > 2 {
		return StorageClass{}, config.ErrStorageClassValue(nil).Msg("Too many sections in " + storageClassEnv)
	} else if len(s) < 2 {
		return StorageClass{}, config.ErrStorageClassValue(nil).Msg("Too few sections in " + storageClassEnv)
	}

	// only allowed scheme is "EC"
	if s[0] != schemePrefix {

  // resources have not been allocated yet.
  // +optional
  optional AllocationResult allocation = 2;

  // ReservedFor indicates which entities are currently allowed to use
  // the claim. A Pod which references a ResourceClaim which is not
  // reserved for that Pod will not be started.
  //
  // There can be at most 32 such reservations. This may get increased in

   * requireNonNull} or the like just to assert that.
   *
   * <p>{@code EqualsTester} will always check that every object it is given returns false from
   * {@code equals(null)}, so it is neither useful nor allowed to include a null value in any
   * equality group.
   */
  @CanIgnoreReturnValue
  public EqualsTester addEqualityGroup(@Nullable Object @Nullable ... equalityGroup) {
    checkNotNull(equalityGroup);

		return nil
	}
	return &AuthZPlugin{
		args:   args,
		client: &http.Client{Transport: args.Transport},
	}
}

// IsAllowed - checks given policy args is allowed to continue the REST API.
func (o *AuthZPlugin) IsAllowed(args policy.Args) (bool, error) {
	if o == nil {
		return false, nil
	}

	// Access Management Plugin Input
	body := make(map[string]interface{})

    /*
     * Don't bother testing. All non-primitive parameters are used only to construct error messages.
     * We never want to pass null for them, so we haven't annotated them to say that null is
     * allowed. But at the same time, it seems wasteful to bother inserting the checkNotNull calls
     * that NullPointerTester wants.
     *
     * (This empty method disables the automatic null testing provided by PackageSanityTests.)

allows WORM for specific objects or by configuring a bucket with default object lock configuration that applies default retention mode and retention duration to all objects. This makes objects in the bucket immutable i.e. delete of the version are not allowed until an expiry specified in the bucket's object lock configuration or object retention.

Object locking requires locking to be enabled on a bucket at the time of bucket creation refer to `mc mb --with-lock`, object locking enables versioning...