Strange issue with smtpd_recipient_restrictions and (possibly) Greylisting. Bug?

Hello,

I am getting a strange error in my mail system (Centos7/Postfix):

May 25 06:44:47 myserver postfix/smtpd[1697]: warning: restriction check_policy_service' after permit’ is ignored

I checked the main.cf file and realised that the ‘permit’ was indeed after the check_policy_service. I corrected that manually in the main.cf file so the line now looks like this:

smtpd_recipient_restrictions = reject_unauth_pipelining permit_mynetworks permit_sasl_authenticated reject_unauth_destination reject_rbl_client b.barracudacentral.org reject_rbl_client zen.spamhaus.org check_policy_service unix:/var/spool/postfix/postgrey/socket permit

The problem is however that after a few days I realised that the same thing happened again. The ‘permit’ was again BEFORE the check_policy_service. I certainly did not put there myself so I am suspecting that while making changes via the control panel (i.e adding whitelisted MTAs to the Greylist section of Virtualmin) this was affected. If it wasn’t that then it is somehow related to my other problem (Post https://www.virtualmin.com/node/40827 ).

Questions:

A)
Is my original smtpd_recipient_restrictions correct by putting the permit at the very end?

B)
If A is correct then why is this happening? Bug?

Anyone?