As long as we have a least one instance that federates with all instances it's OK to me for individual instances to block instances that don't fit with what the administrator wants.