Moved permission check from run_command to handle_command