I am having trouble getting custom permissions to work. I created a kit and set permissions using "/kit permission pvp". 
But even when this is set, any player can still redeem the kit whether they have that permission or not if hide is set to false. If hide is set to true, noone can claim the kit. 

I have at least 18 hidden kits as well as Admin which cannot be claimed as they are hidden,
I have 6 kits which are not hidden but have permissions set for time on server, they cannot be redeemed if you do not have the permission, you just get the message stating "you do not have permission etc" all my bot kits are npc only and hidden and cant be redeemed even by admin unless edited to be npconly-false.
You might have accidently given permissions , I would revoke all permissions and they go through the list of who gets what permission to make sure only they (or group) has what you want them to have.