allow otapreopt_slot self:capability sys_admin;