Am I losing my mind, or is there a blog post about modeling service-level permissions that I just can’t find?