Merge "Allow permissions to be runtime-only." into oc-dev