modify the protectionLevel: prefer the manfest inside permission