Merge "Allow permissions to be denied" into oc-mr1-dev