diff --git a/tools/aconfig/src/cache.rs b/tools/aconfig/src/cache.rs
index d27459d..f7b0f2d 100644
--- a/tools/aconfig/src/cache.rs
+++ b/tools/aconfig/src/cache.rs
@@ -18,18 +18,19 @@
 use serde::{Deserialize, Serialize};
 use std::io::{Read, Write};
 
-use crate::aconfig::{Flag, Override};
+use crate::aconfig::{Flag, Override, Permission};
 use crate::commands::Source;
 
-#[derive(Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Debug)]
 pub struct Item {
     pub id: String,
     pub description: String,
     pub value: bool,
+    pub permission: Permission,
     pub debug: Vec<String>,
 }
 
-#[derive(Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Debug)]
 pub struct Cache {
     build_id: u32,
     items: Vec<Item>,
@@ -56,12 +57,13 @@
                 source,
             ));
         }
-        let value = flag.resolve_value(self.build_id);
+        let (value, permission) = flag.resolve(self.build_id);
         self.items.push(Item {
             id: flag.id.clone(),
             description: flag.description,
             value,
-            debug: vec![format!("{}:{}", source, value)],
+            permission,
+            debug: vec![format!("{}:{} {:?}", source, value, permission)],
         });
         Ok(())
     }
@@ -71,7 +73,10 @@
             return Err(anyhow!("failed to override flag {}: unknown flag", override_.id));
         };
         existing_item.value = override_.value;
-        existing_item.debug.push(format!("{}:{}", source, override_.value));
+        existing_item.permission = override_.permission;
+        existing_item
+            .debug
+            .push(format!("{}:{} {:?}", source, override_.value, override_.permission));
         Ok(())
     }
 
@@ -85,7 +90,7 @@
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::aconfig::Value;
+    use crate::aconfig::{Permission, Value};
 
     #[test]
     fn test_add_flag() {
@@ -96,7 +101,7 @@
                 Flag {
                     id: "foo".to_string(),
                     description: "desc".to_string(),
-                    values: vec![Value::default(true)],
+                    values: vec![Value::default(true, Permission::ReadOnly)],
                 },
             )
             .unwrap();
@@ -106,7 +111,7 @@
                 Flag {
                     id: "foo".to_string(),
                     description: "desc".to_string(),
-                    values: vec![Value::default(false)],
+                    values: vec![Value::default(false, Permission::ReadOnly)],
                 },
             )
             .unwrap_err();
@@ -118,13 +123,17 @@
 
     #[test]
     fn test_add_override() {
-        fn check_value(cache: &Cache, id: &str, expected: bool) -> bool {
-            cache.iter().find(|&item| item.id == id).unwrap().value == expected
+        fn check(cache: &Cache, id: &str, expected: (bool, Permission)) -> bool {
+            let item = cache.iter().find(|&item| item.id == id).unwrap();
+            item.value == expected.0 && item.permission == expected.1
         }
 
         let mut cache = Cache::new(1);
         let error = cache
-            .add_override(Source::Memory, Override { id: "foo".to_string(), value: true })
+            .add_override(
+                Source::Memory,
+                Override { id: "foo".to_string(), value: true, permission: Permission::ReadOnly },
+            )
             .unwrap_err();
         assert_eq!(&format!("{:?}", error), "failed to override flag foo: unknown flag");
 
@@ -134,20 +143,28 @@
                 Flag {
                     id: "foo".to_string(),
                     description: "desc".to_string(),
-                    values: vec![Value::default(true)],
+                    values: vec![Value::default(true, Permission::ReadOnly)],
                 },
             )
             .unwrap();
-        assert!(check_value(&cache, "foo", true));
+        dbg!(&cache);
+        assert!(check(&cache, "foo", (true, Permission::ReadOnly)));
 
         cache
-            .add_override(Source::Memory, Override { id: "foo".to_string(), value: false })
+            .add_override(
+                Source::Memory,
+                Override { id: "foo".to_string(), value: false, permission: Permission::ReadWrite },
+            )
             .unwrap();
-        assert!(check_value(&cache, "foo", false));
+        dbg!(&cache);
+        assert!(check(&cache, "foo", (false, Permission::ReadWrite)));
 
         cache
-            .add_override(Source::Memory, Override { id: "foo".to_string(), value: true })
+            .add_override(
+                Source::Memory,
+                Override { id: "foo".to_string(), value: true, permission: Permission::ReadWrite },
+            )
             .unwrap();
-        assert!(check_value(&cache, "foo", true));
+        assert!(check(&cache, "foo", (true, Permission::ReadWrite)));
     }
 }