add permission requirement to manage blocks