This is what y_commands and y_groups has done for years. Never mind a single flag, or even excess code within a command:
No need for checking in the command at all, and a great deal more flexibility with that.
It doesn't actually read those permissions from a file currently, but doing so is trivial, since they are already dynamic.
PHP Code:
Group_SetCommandGlobal(YCMD:promote, false); // Disable this command for everyone.
Group_SetCommand(gAdminGroup, YCMD:promote, true); // Enable it for admins.
No need for checking in the command at all, and a great deal more flexibility with that.
It doesn't actually read those permissions from a file currently, but doing so is trivial, since they are already dynamic.