looks like it should belong to PermissionPolicyManager rather than to service