Merge "Guard CDM watch profile behind its permission" into sc-dev