diff --git a/apps/emqx/src/emqx_config.erl b/apps/emqx/src/emqx_config.erl
index d6c257071..ae41ee1a1 100644
--- a/apps/emqx/src/emqx_config.erl
+++ b/apps/emqx/src/emqx_config.erl
@@ -87,8 +87,14 @@
 -type update_request() :: term().
 -type update_cmd() :: {update, update_request()} | remove.
 -type update_opts() :: #{
-        %% fill the default values into the rawconf map
-        rawconf_with_defaults => boolean()
+        %% rawconf_with_defaults:
+        %%   fill the default values into the `raw_config` field of the return value
+        %%   defaults to `false`
+        rawconf_with_defaults => boolean(),
+        %% persistent:
+        %%   save the updated config to the emqx_override.conf file
+        %%   defaults to `true`
+        persistent => boolean()
     }.
 -type update_args() :: {update_cmd(), Opts :: update_opts()}.
 -type update_stage() :: pre_config_update | post_config_update.
@@ -339,6 +345,8 @@ save_to_config_map(Conf, RawConf) ->
     ?MODULE:put_raw(RawConf).
 
 -spec save_to_override_conf(raw_config()) -> ok | {error, term()}.
+save_to_override_conf(undefined) ->
+    ok;
 save_to_override_conf(RawConf) ->
     FileName = emqx_override_conf_name(),
     ok = filelib:ensure_dir(FileName),
diff --git a/apps/emqx/src/emqx_config_handler.erl b/apps/emqx/src/emqx_config_handler.erl
index f16f8a97a..a9020a87a 100644
--- a/apps/emqx/src/emqx_config_handler.erl
+++ b/apps/emqx/src/emqx_config_handler.erl
@@ -134,17 +134,17 @@ terminate(_Reason, _State) ->
 code_change(_OldVsn, State, _Extra) ->
     {ok, State}.
 
-process_update_request(ConfKeyPath, _Handlers, {remove, _Opts}) ->
+process_update_request(ConfKeyPath, _Handlers, {remove, Opts}) ->
     OldRawConf = emqx_config:get_root_raw(ConfKeyPath),
     BinKeyPath = bin_path(ConfKeyPath),
     NewRawConf = emqx_map_lib:deep_remove(BinKeyPath, OldRawConf),
-    OverrideConf = emqx_map_lib:deep_remove(BinKeyPath, emqx_config:read_override_conf()),
+    OverrideConf = remove_from_override_config(BinKeyPath, Opts),
     {ok, NewRawConf, OverrideConf};
-process_update_request(ConfKeyPath, Handlers, {{update, UpdateReq}, _Opts}) ->
+process_update_request(ConfKeyPath, Handlers, {{update, UpdateReq}, Opts}) ->
     OldRawConf = emqx_config:get_root_raw(ConfKeyPath),
     case do_update_config(ConfKeyPath, Handlers, OldRawConf, UpdateReq) of
         {ok, NewRawConf} ->
-            OverrideConf = update_override_config(NewRawConf),
+            OverrideConf = update_override_config(NewRawConf, Opts),
             {ok, NewRawConf, OverrideConf};
         Error -> Error
     end.
@@ -237,7 +237,15 @@ merge_to_old_config(UpdateReq, RawConf) when is_map(UpdateReq), is_map(RawConf)
 merge_to_old_config(UpdateReq, _RawConf) ->
     {ok, UpdateReq}.
 
-update_override_config(RawConf) ->
+remove_from_override_config(_BinKeyPath, #{persistent := false}) ->
+    undefined;
+remove_from_override_config(BinKeyPath, _Opts) ->
+    OldConf = emqx_config:read_override_conf(),
+    emqx_map_lib:deep_remove(BinKeyPath, OldConf).
+
+update_override_config(_RawConf, #{persistent := false}) ->
+    undefined;
+update_override_config(RawConf, _Opts) ->
     OldConf = emqx_config:read_override_conf(),
     maps:merge(OldConf, RawConf).
 
diff --git a/apps/emqx_authz/src/emqx_authz.erl b/apps/emqx_authz/src/emqx_authz.erl
index 0d116882c..f950ed53c 100644
--- a/apps/emqx_authz/src/emqx_authz.erl
+++ b/apps/emqx_authz/src/emqx_authz.erl
@@ -30,7 +30,9 @@
         , lookup/0
         , lookup/1
         , move/2
+        , move/3
         , update/2
+        , update/3
         , authorize/5
         ]).
 
@@ -58,19 +60,25 @@ lookup(Type) ->
         error:Reason -> {error, Reason}
     end.
 
-move(Type, #{<<"before">> := Before}) ->
-    emqx:update_config(?CONF_KEY_PATH, {move, atom(Type), #{<<"before">> => atom(Before)}});
-move(Type, #{<<"after">> := After}) ->
-    emqx:update_config(?CONF_KEY_PATH, {move, atom(Type), #{<<"after">> => atom(After)}});
-move(Type, Position) ->
-    emqx:update_config(?CONF_KEY_PATH, {move, atom(Type), Position}).
+move(Type, Cmd) ->
+    move(Type, Cmd, #{}).
+
+move(Type, #{<<"before">> := Before}, Opts) ->
+    emqx:update_config(?CONF_KEY_PATH, {move, atom(Type), #{<<"before">> => atom(Before)}}, Opts);
+move(Type, #{<<"after">> := After}, Opts) ->
+    emqx:update_config(?CONF_KEY_PATH, {move, atom(Type), #{<<"after">> => atom(After)}}, Opts);
+move(Type, Position, Opts) ->
+    emqx:update_config(?CONF_KEY_PATH, {move, atom(Type), Position}, Opts).
 
-update({replace_once, Type}, Sources) ->
-    emqx:update_config(?CONF_KEY_PATH, {{replace_once, atom(Type)}, Sources});
-update({delete_once, Type}, Sources) ->
-    emqx:update_config(?CONF_KEY_PATH, {{delete_once, atom(Type)}, Sources});
 update(Cmd, Sources) ->
-    emqx:update_config(?CONF_KEY_PATH, {Cmd, Sources}).
+    update(Cmd, Sources, #{}).
+
+update({replace_once, Type}, Sources, Opts) ->
+    emqx:update_config(?CONF_KEY_PATH, {{replace_once, atom(Type)}, Sources}, Opts);
+update({delete_once, Type}, Sources, Opts) ->
+    emqx:update_config(?CONF_KEY_PATH, {{delete_once, atom(Type)}, Sources}, Opts);
+update(Cmd, Sources, Opts) ->
+    emqx:update_config(?CONF_KEY_PATH, {Cmd, Sources}, Opts).
 
 pre_config_update({move, Type, <<"top">>}, Conf) when is_list(Conf) ->
     {Index, _} = find_source_by_type(Type),