Since we now accurately track database usages, we can
relax where they are defined. They can still only be *used*
from within services, to ensure permissions are mapped correctly.