- split namespace-grant from lockbox service so it can be reused for multiple services (e.g. rolodex and lockbox) so user doesn't have to request multiple grants from different services