SCHEMA-533. Locks instances when updating permissions.

Reviewed by: aaron