Should permission be granted to the container?
Should permission be granted only to a specific object?
Should permission be granted to the entire service?