add permission to the command route