Perhaps one solution could be: If the user changed the drop down button, assume the user was trying do do something and show a confirmation message box like the following but instead with the text:
You changed the permissions, but did not apply them. Are you sure you want to let everybody see this category?
