Some clients in some countries may be riskier than others, and it becomes necessary to block certain customers from using certain gateways.

Add an option to client groups to limit which gateways clients in that group can use. By default it should have no restrictions, meaning unless changed all gateways should be available.

When editing a client group, add a new section for "Allowed Gateways". In the box, list all gateways but have a checkout called "Allow All", checked by default. In unchecked, then a checkbox becomes enabled next to a listing of all gateways. Only the gateways enabled, (if not all) can be used by clients in the group.

On a client's profile page replicate these options so that they can be overridden on a per-client basis also. Allow the options to be inherited, or set my own options. Where should this go? A new section under Account Actions for "Allowed Gateways" that defaults to "Inherit from Client Group"?

During order form checkout, make sure the Client Group settings are used for the Client Group assigned to the Order form. They should be able to select a gateway assigned to the order form that the group also supports. We may want another task that makes it obvious what gateways are unusable because of the Client Group settings.