add permission checking for admin command