If you watch other movies in the Blumiverse, like "Ouija: Origin of Evil" (most recently) or even in the original "Insidious" trilogy, you'll find that it's not ever actually about "permission".
If the films do agree on a common lore, it's usually actually that there's a common theme of desperation, deception, and evil in all the hauntings and possessions.
In the Blumiverse, it appears that the "spirits" (usually Demons) will actually start-out by pretending like they are someone else, or even latching onto another more innocuous seeming spirit, and they will often suggest that they simply need permission to possess a toy or a child or just generally make some kind of sorta reasonable request that retroactively seems to have been them establishing a foothold in the physical world.
Yet, in most of the Blumiverse films, at final reflection of the events of the film(s), it appears that the demonic presence was actually capable all along, and really everything it was doing was about breaking down peoples' willpower or cautions.
The Demons can clearly be overcome with willpower and they seemingly can be fought if not also destroyed. There isn't a specific religious discussion in the Blumiverse, but it does lean heavily towards a general suggestion of Christian (if not Catholic) spirituality being able to ward-off demonic presences. This means that if the Demons just popped-off on a Thursday and tried possessing someone, they'd probably get shot-down pretty quick -- and it'd be a boring movie.
By whittling away at people by making things seem normal when they aren't -- liking talking toys/dolls -- or by pretending to be a loved-one trapped between life and death, the demonic presence is trying to get people to not only lower their guards, but to actually basically want the possession to occur.
No one ever really gave permission in "Annabelle: Creation" except the parents, but then they realized pretty quickly that they f----d-up real bad, and they couldn't undo anything or take away their permission.
If the Demon really needed them to give their permission, they should just as easily be able to revoke it, if they actually had that power.
The "Insidious" and "The Conjuring" series both go more into the details of the "rules" in the extended Blumiverse.
We are all probably reading way too much into any of it ... but it makes it entertaining, so who cares!?
The ever-expanding connected depths of the Blumiverse movies are really really starting to pay-off, and even beyond any superhero franchise universe, the build-up to the ultimate villain -- The Nun -- is so ridiculously over-the-top that personally I think the eventual spin-off might end-up being the most entertaining horror movie of our time.
Summary: It's a scam. No need for permission. It's a demon. It's just f---ing with us all. Watch all the "Insidious" and "The Conjuring" movies, and also definitely check-out "Lights Out" and "Ouija: Origin of Evil" and "Oculus". Prepare your mind, body, and soul for "The Nun" .
P.S. -- Blumiverse == Blumhouse Productions In-Film-Continuity Universe
P.P.S. -- I guess if you wanna be boring, you could call it the "The Conjuring"-Universe ... but that doesn't respect all the time periods and inter-relations between all the films.