register command + permission in plugin.yml and restrict command to the permission