 is the <code>visibility</code> label of the destination service having the value <code>external</code>.</li></ul><h3 id=servicemethod-level-isolation-withwithout-primary-identities>Service/method level isolation with/without primary identities</h3><p>Here is another example that demonstrates finer grained access control at service/method level. The first step
is to define a <code>book-reader</code> service role that allows READ access to <code>/books/*</code> resource in <code>bookstore</code> service.</p>