Merge "Allow permissions to be runtime-only." into oc-dev am: 941e9e2b38
am: 57a9464831

Change-Id: Ibf8b8f13ff5a8819671142e77ee238ba08805d40