When you call a RESTlet from Postman (externally) that RESTlet is subject to the role related to the Integration used by that RESTlet.