Cleaning up logic and adding better documentation for `PermissionService.updatePermission()`