Permission can only be set at AndroidManifest.xml.

This statement is incorrect. Permissions can also be set programmatically in the Java or Kotlin code of an Android app using the following methods:

1. ContextCompat.checkSelfPermission() - to check if a permission is already granted by the user
2. ActivityCompat.requestPermissions() - to request a permission from the user
3. onRequestPermissionsResult() - to handle the user's response to the permission request

Additionally, permissions can also be set using the Gradle build system by adding the required permissions to the app's build.gradle file.