Permissions with the new internal protection level are similar to signature permissions in that they can be controlled internally by the system via the specified protection flags, but they are no longer granted according to signatures. This enables us to create role-only permissions. Bug: 158736025 Test: presubmit Change-Id: Ie5f76f14d6e32b05b9113090e10b8a1a41a2d9da