Merge "Allow explicit permission denial" into oc-mr1-dev
am: 7fc53a11f8

Change-Id: I4772c35c57a9b8789417d5e04292c206a001d7e4