Better way to architect plugins that require staff permissions.