Core/RBAC: Move ticket commands to RBAC (using individual permissions)