ticket:9 add permission check for script