The update mask applies to the settings. Only the top level
fields of AccessApprovalSettings (notification_emails &
enrolled_services) are supported. For each field, if it is
included, the currently stored value will be entirely
overwritten with the value of the field passed in this
For the ``FieldMask`` definition, see
If this field is left unset, only the notification_emails
field will be updated.