Is this needed?  Won't external_variables provide the lookup_keys permissions, or are you deliberately duplicating them (it doesn't seem so, because the test says you still need external_variables)?