permissions: don't overcomplicate filtering out service types