Core/RBAC: Move modify commands to RBAC (using individual permissions)