diff --git a/clients/cli/general.c b/clients/cli/general.c
index 123cc5b4fc..8d9e1b3929 100644
--- a/clients/cli/general.c
+++ b/clients/cli/general.c
@@ -582,7 +582,10 @@ got_permissions (NmCli *nmc)
 	NMClientPermission perm;
 
 	/* The server returns all the permissions at once, so if at least one is there
-	 * we already received the reply. */
+	 * we already received the reply.
+	 *
+	 * FIXME: this is wrong, because all permissions could be unknown. We should instead
+	 * have a signal in NMClient to indicate when permissions are received. */
 	for (perm = NM_CLIENT_PERMISSION_NONE + 1; perm <= NM_CLIENT_PERMISSION_LAST; perm++) {
 		if (nm_client_get_permission_result (nmc->client, perm) != NM_CLIENT_PERMISSION_RESULT_UNKNOWN)
 			return TRUE;
diff --git a/src/nm-manager.c b/src/nm-manager.c
index 22d5a88a86..8540a88f43 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -6210,9 +6210,10 @@ get_perm_add_result (NMManager *self, NMAuthChain *chain, GVariantBuilder *resul
 		g_variant_builder_add (results, "{ss}", permission, "no");
 	else if (result == NM_AUTH_CALL_RESULT_AUTH)
 		g_variant_builder_add (results, "{ss}", permission, "auth");
-	else {
-		_LOGD (LOGD_CORE, "unknown auth chain result %d", result);
-	}
+	else if (result == NM_AUTH_CALL_RESULT_UNKNOWN)
+		g_variant_builder_add (results, "{ss}", permission, "unknown");
+	else
+		nm_assert_not_reached ();
 }
 
 static void