Improved permission checks in AgentTicketWatcher.