LPS-50574 use local service + explicit permission check