Merge "Only check caller when deriving permissions." into klp-dev