Core/RBAC: Move bf commands to RBAC (using individual permissions)