code: def can_approve(self, user, **data):
          
          is_external = data.get('service_type', self.service_type) == 'external'
          raise Return(user.is_admin() or is_external)
docs: Only sys admins can approve a service
          :param user: a User
          :param data: data that the user wants to update