Came here to say the same thing. A general-purpose microservice that handles authentication or sends user notifications would be prohibited by this restriction.