clarified 'external service' permission