added permission check for ATM creation