It's worth checking the permission analyzer for the specific case you're testing to see the elements at play (and confirm they're working as you expect). It may also help show if there's an add-on interfering (such as by preventing permission rebuilds, which has happened).