Restrict internal extension calls

The simplest way is Custom Contexts.
This example shows access to just one ring group and to a limited extension range.