is this more of a feel good type requirement, where you would feel better if one service couldn't write to the object types ostensibly managed by another service, or is this a hard requirement?