diff --git a/tools/aconfig/src/aconfig.rs b/tools/aconfig/src/aconfig.rs
index 22fcb88..dc185f0 100644
--- a/tools/aconfig/src/aconfig.rs
+++ b/tools/aconfig/src/aconfig.rs
@@ -15,25 +15,46 @@
  */
 
 use anyhow::{anyhow, Context, Error, Result};
+use protobuf::{Enum, EnumOrUnknown};
+use serde::{Deserialize, Serialize};
 
 use crate::protos::{
-    ProtoAndroidConfig, ProtoFlag, ProtoOverride, ProtoOverrideConfig, ProtoValue,
+    ProtoAndroidConfig, ProtoFlag, ProtoOverride, ProtoOverrideConfig, ProtoPermission, ProtoValue,
 };
 
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize, Clone, Copy)]
+pub enum Permission {
+    ReadOnly,
+    ReadWrite,
+}
+
+impl TryFrom<EnumOrUnknown<ProtoPermission>> for Permission {
+    type Error = Error;
+
+    fn try_from(proto: EnumOrUnknown<ProtoPermission>) -> Result<Self, Self::Error> {
+        match ProtoPermission::from_i32(proto.value()) {
+            Some(ProtoPermission::READ_ONLY) => Ok(Permission::ReadOnly),
+            Some(ProtoPermission::READ_WRITE) => Ok(Permission::ReadWrite),
+            None => Err(anyhow!("unknown permission enum value {}", proto.value())),
+        }
+    }
+}
+
 #[derive(Debug, PartialEq, Eq)]
 pub struct Value {
     value: bool,
+    permission: Permission,
     since: Option<u32>,
 }
 
 #[allow(dead_code)] // only used in unit tests
 impl Value {
-    pub fn new(value: bool, since: u32) -> Value {
-        Value { value, since: Some(since) }
+    pub fn new(value: bool, permission: Permission, since: u32) -> Value {
+        Value { value, permission, since: Some(since) }
     }
 
-    pub fn default(value: bool) -> Value {
-        Value { value, since: None }
+    pub fn default(value: bool, permission: Permission) -> Value {
+        Value { value, permission, since: None }
     }
 }
 
@@ -44,7 +65,11 @@
         let Some(value) = proto.value else {
             return Err(anyhow!("missing 'value' field"));
         };
-        Ok(Value { value, since: proto.since })
+        let Some(proto_permission) = proto.permission else {
+            return Err(anyhow!("missing 'permission' field"));
+        };
+        let permission = proto_permission.try_into()?;
+        Ok(Value { value, permission, since: proto.since })
     }
 }
 
@@ -72,15 +97,17 @@
         proto.flag.into_iter().map(|proto_flag| proto_flag.try_into()).collect()
     }
 
-    pub fn resolve_value(&self, build_id: u32) -> bool {
+    pub fn resolve(&self, build_id: u32) -> (bool, Permission) {
         let mut value = self.values[0].value;
+        let mut permission = self.values[0].permission;
         for candidate in self.values.iter().skip(1) {
             let since = candidate.since.expect("invariant: non-defaults values have Some(since)");
             if since <= build_id {
                 value = candidate.value;
+                permission = candidate.permission;
             }
         }
-        value
+        (value, permission)
     }
 }
 
@@ -120,6 +147,7 @@
 pub struct Override {
     pub id: String,
     pub value: bool,
+    pub permission: Permission,
 }
 
 impl Override {
@@ -145,7 +173,11 @@
         let Some(value) = proto.value else {
             return Err(anyhow!("missing 'value' field"));
         };
-        Ok(Override { id, value })
+        let Some(proto_permission) = proto.permission else {
+            return Err(anyhow!("missing 'permission' field"));
+        };
+        let permission = proto_permission.try_into()?;
+        Ok(Override { id, value, permission })
     }
 }
 
@@ -158,7 +190,10 @@
         let expected = Flag {
             id: "1234".to_owned(),
             description: "Description of the flag".to_owned(),
-            values: vec![Value::default(false), Value::new(true, 8)],
+            values: vec![
+                Value::default(false, Permission::ReadOnly),
+                Value::new(true, Permission::ReadWrite, 8),
+            ],
         };
 
         let s = r#"
@@ -166,9 +201,11 @@
         description: "Description of the flag"
         value {
             value: false
+            permission: READ_ONLY
         }
         value {
             value: true
+            permission: READ_WRITE
             since: 8
         }
         "#;
@@ -190,6 +227,7 @@
         description: "Description of the flag"
         value {
             value: true
+            permission: READ_ONLY
         }
         "#;
         let error = Flag::try_from_text_proto(s).unwrap_err();
@@ -200,9 +238,11 @@
         description: "Description of the flag"
         value {
             value: true
+            permission: READ_ONLY
         }
         value {
             value: true
+            permission: READ_ONLY
         }
         "#;
         let error = Flag::try_from_text_proto(s).unwrap_err();
@@ -215,12 +255,12 @@
             Flag {
                 id: "a".to_owned(),
                 description: "A".to_owned(),
-                values: vec![Value::default(true)],
+                values: vec![Value::default(true, Permission::ReadOnly)],
             },
             Flag {
                 id: "b".to_owned(),
                 description: "B".to_owned(),
-                values: vec![Value::default(false)],
+                values: vec![Value::default(false, Permission::ReadWrite)],
             },
         ];
 
@@ -230,6 +270,7 @@
             description: "A"
             value {
                 value: true
+                permission: READ_ONLY
             }
         }
         flag {
@@ -237,6 +278,7 @@
             description: "B"
             value {
                 value: false
+                permission: READ_WRITE
             }
         }
         "#;
@@ -247,11 +289,13 @@
 
     #[test]
     fn test_override_try_from_text_proto_list() {
-        let expected = Override { id: "1234".to_owned(), value: true };
+        let expected =
+            Override { id: "1234".to_owned(), value: true, permission: Permission::ReadOnly };
 
         let s = r#"
         id: "1234"
         value: true
+        permission: READ_ONLY
         "#;
         let actual = Override::try_from_text_proto(s).unwrap();
 
@@ -259,26 +303,26 @@
     }
 
     #[test]
-    fn test_resolve_value() {
+    fn test_flag_resolve() {
         let flag = Flag {
             id: "a".to_owned(),
             description: "A".to_owned(),
             values: vec![
-                Value::default(true),
-                Value::new(false, 10),
-                Value::new(true, 20),
-                Value::new(false, 30),
+                Value::default(false, Permission::ReadOnly),
+                Value::new(false, Permission::ReadWrite, 10),
+                Value::new(true, Permission::ReadOnly, 20),
+                Value::new(true, Permission::ReadWrite, 30),
             ],
         };
-        assert!(flag.resolve_value(0));
-        assert!(flag.resolve_value(9));
-        assert!(!flag.resolve_value(10));
-        assert!(!flag.resolve_value(11));
-        assert!(!flag.resolve_value(19));
-        assert!(flag.resolve_value(20));
-        assert!(flag.resolve_value(21));
-        assert!(flag.resolve_value(29));
-        assert!(!flag.resolve_value(30));
-        assert!(!flag.resolve_value(10_000));
+        assert_eq!((false, Permission::ReadOnly), flag.resolve(0));
+        assert_eq!((false, Permission::ReadOnly), flag.resolve(9));
+        assert_eq!((false, Permission::ReadWrite), flag.resolve(10));
+        assert_eq!((false, Permission::ReadWrite), flag.resolve(11));
+        assert_eq!((false, Permission::ReadWrite), flag.resolve(19));
+        assert_eq!((true, Permission::ReadOnly), flag.resolve(20));
+        assert_eq!((true, Permission::ReadOnly), flag.resolve(21));
+        assert_eq!((true, Permission::ReadOnly), flag.resolve(29));
+        assert_eq!((true, Permission::ReadWrite), flag.resolve(30));
+        assert_eq!((true, Permission::ReadWrite), flag.resolve(10_000));
     }
 }
diff --git a/tools/aconfig/src/cache.rs b/tools/aconfig/src/cache.rs
index d27459d..f7b0f2d 100644
--- a/tools/aconfig/src/cache.rs
+++ b/tools/aconfig/src/cache.rs
@@ -18,18 +18,19 @@
 use serde::{Deserialize, Serialize};
 use std::io::{Read, Write};
 
-use crate::aconfig::{Flag, Override};
+use crate::aconfig::{Flag, Override, Permission};
 use crate::commands::Source;
 
-#[derive(Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Debug)]
 pub struct Item {
     pub id: String,
     pub description: String,
     pub value: bool,
+    pub permission: Permission,
     pub debug: Vec<String>,
 }
 
-#[derive(Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Debug)]
 pub struct Cache {
     build_id: u32,
     items: Vec<Item>,
@@ -56,12 +57,13 @@
                 source,
             ));
         }
-        let value = flag.resolve_value(self.build_id);
+        let (value, permission) = flag.resolve(self.build_id);
         self.items.push(Item {
             id: flag.id.clone(),
             description: flag.description,
             value,
-            debug: vec![format!("{}:{}", source, value)],
+            permission,
+            debug: vec![format!("{}:{} {:?}", source, value, permission)],
         });
         Ok(())
     }
@@ -71,7 +73,10 @@
             return Err(anyhow!("failed to override flag {}: unknown flag", override_.id));
         };
         existing_item.value = override_.value;
-        existing_item.debug.push(format!("{}:{}", source, override_.value));
+        existing_item.permission = override_.permission;
+        existing_item
+            .debug
+            .push(format!("{}:{} {:?}", source, override_.value, override_.permission));
         Ok(())
     }
 
@@ -85,7 +90,7 @@
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::aconfig::Value;
+    use crate::aconfig::{Permission, Value};
 
     #[test]
     fn test_add_flag() {
@@ -96,7 +101,7 @@
                 Flag {
                     id: "foo".to_string(),
                     description: "desc".to_string(),
-                    values: vec![Value::default(true)],
+                    values: vec![Value::default(true, Permission::ReadOnly)],
                 },
             )
             .unwrap();
@@ -106,7 +111,7 @@
                 Flag {
                     id: "foo".to_string(),
                     description: "desc".to_string(),
-                    values: vec![Value::default(false)],
+                    values: vec![Value::default(false, Permission::ReadOnly)],
                 },
             )
             .unwrap_err();
@@ -118,13 +123,17 @@
 
     #[test]
     fn test_add_override() {
-        fn check_value(cache: &Cache, id: &str, expected: bool) -> bool {
-            cache.iter().find(|&item| item.id == id).unwrap().value == expected
+        fn check(cache: &Cache, id: &str, expected: (bool, Permission)) -> bool {
+            let item = cache.iter().find(|&item| item.id == id).unwrap();
+            item.value == expected.0 && item.permission == expected.1
         }
 
         let mut cache = Cache::new(1);
         let error = cache
-            .add_override(Source::Memory, Override { id: "foo".to_string(), value: true })
+            .add_override(
+                Source::Memory,
+                Override { id: "foo".to_string(), value: true, permission: Permission::ReadOnly },
+            )
             .unwrap_err();
         assert_eq!(&format!("{:?}", error), "failed to override flag foo: unknown flag");
 
@@ -134,20 +143,28 @@
                 Flag {
                     id: "foo".to_string(),
                     description: "desc".to_string(),
-                    values: vec![Value::default(true)],
+                    values: vec![Value::default(true, Permission::ReadOnly)],
                 },
             )
             .unwrap();
-        assert!(check_value(&cache, "foo", true));
+        dbg!(&cache);
+        assert!(check(&cache, "foo", (true, Permission::ReadOnly)));
 
         cache
-            .add_override(Source::Memory, Override { id: "foo".to_string(), value: false })
+            .add_override(
+                Source::Memory,
+                Override { id: "foo".to_string(), value: false, permission: Permission::ReadWrite },
+            )
             .unwrap();
-        assert!(check_value(&cache, "foo", false));
+        dbg!(&cache);
+        assert!(check(&cache, "foo", (false, Permission::ReadWrite)));
 
         cache
-            .add_override(Source::Memory, Override { id: "foo".to_string(), value: true })
+            .add_override(
+                Source::Memory,
+                Override { id: "foo".to_string(), value: true, permission: Permission::ReadWrite },
+            )
             .unwrap();
-        assert!(check_value(&cache, "foo", true));
+        assert!(check(&cache, "foo", (true, Permission::ReadWrite)));
     }
 }
diff --git a/tools/aconfig/src/commands.rs b/tools/aconfig/src/commands.rs
index 4976fb2..bc22363 100644
--- a/tools/aconfig/src/commands.rs
+++ b/tools/aconfig/src/commands.rs
@@ -103,6 +103,7 @@
             description: "Description of a"
             value {
                 value: true
+                permission: READ_ONLY
             }
         }
         "#;
@@ -111,6 +112,7 @@
         override {
             id: "a"
             value: false
+            permission: READ_ONLY
         }
         "#;
         let overrides = vec![Input { source: Source::Memory, reader: Box::new(o.as_bytes()) }];
diff --git a/tools/aconfig/src/protos.rs b/tools/aconfig/src/protos.rs
index 3c156b3..e9a1ab5 100644
--- a/tools/aconfig/src/protos.rs
+++ b/tools/aconfig/src/protos.rs
@@ -42,6 +42,9 @@
 #[cfg(not(feature = "cargo"))]
 pub use aconfig_protos::aconfig::Override as ProtoOverride;
 
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Permission as ProtoPermission;
+
 // ---- When building with cargo ----
 #[cfg(feature = "cargo")]
 include!(concat!(env!("OUT_DIR"), "/aconfig_proto/mod.rs"));
@@ -61,6 +64,9 @@
 #[cfg(feature = "cargo")]
 pub use aconfig::Override as ProtoOverride;
 
+#[cfg(feature = "cargo")]
+pub use aconfig::Permission as ProtoPermission;
+
 // ---- Common for both the Android tool-chain and cargo ----
 use anyhow::Result;