The client hands the server a list of directories it is allowed to use, a boundary the server asks for and the client defines and enforces