The process is organization/company specific.

Generally, I give a timeframe/deadline for a final response and try to reach out with what correspondence we have on file.

I did not need permission, as I am the HR advisor and I help the employers mitigate potential risks. You never know if there is a good reason for a delay in response. Eg: candidate was in the hospital.