It would be cool if the blacklist were customizable based on the user ID. I believe you can get the ID of the one who send the inline request, then before building the response objects check if the user is in the db. If the user is in the db that means they entered a custom blacklist, otherwise use a default blacklist if no user blacklist is found.