root access requirement can now be set for individual subcommands