Permission check for all item operations