handle oneOff permission toggling