Merge changes from topic "12933478" into pi-dev

* changes:
  Revoke permission on non-runtime -> runtime upgrade
  Ensure permissions are revoked on state changes