Create a 2.3 Moodle site. Create a new role called 'Manage blocks role ALL' with no archetype. Grant the following capabilities 'moodle/my:manageblocks' and 'moodle/site:manageblocks'. Create another role called 'Manage blocks role MY' with no archetype. Grant the capability 'moodle/my:manageblocks'. Create another role called 'Manage blocks role SITE' with no archetype. Grant the capability 'moodle/site:manageblocks'. Upgrade to the latest integration master branch. Check that 'Manage blocks role ALL' has allow for the myaddinstance and addinstance capability for each block. Check that 'Manage blocks role MY' has allow for only the myaddinstance capability for each block. Check that 'Manage blocks role SITE' has allow for only the addinstance capability for each block. Log in as a student. Visit the My Moodle page. Check that you can add/remove blocks. Remove some blocks, but not all. Log in as an administrator on separate browser. Go to Users -> Permissions -> Define roles and select authenticated users. Disallow the user to add the blocks you deleted as the student by unselecting allow for the myaddinstance capability, eg. block/<blockname>:myaddinstance. Go back to the user's My Moodle page and confirm you can not add these blocks. Visit a course as this student and ensure they can not add a block. As the administrator visit Users -> Permissions -> Define roles and select authenticated users. Allow the user to add some blocks by selecting allow for the addinstance capability (note. different than myaddinstance), eg. block/<blockname>:addinstance. Allow the user to 'Edit a block's settings' (moodle/block:edit) and 'Manage blocks on a page' (moodle/site:manageblocks). Go back to the user and visit that course. Check that you can add blocks to the course, but only those you specified. Note, if you remove the myaddinstance capability for a block currently on the users page, then they will not be able to remove it. This seems unavoidable without creating a dirty hack.