services.json permissions