* changes: Ask Perm Controller to set policy-fixed perms Guard changing policy_fixed flag behind permission