only trigger privileged service warnings for real commands