added permission for tool subcommand