diff --git a/core/src/main/java/eu/mhsl/craftattack/spawn/core/appliance/Appliance.java b/core/src/main/java/eu/mhsl/craftattack/spawn/core/appliance/Appliance.java
index 1cc14fd..e6abb5b 100644
--- a/core/src/main/java/eu/mhsl/craftattack/spawn/core/appliance/Appliance.java
+++ b/core/src/main/java/eu/mhsl/craftattack/spawn/core/appliance/Appliance.java
@@ -139,6 +139,7 @@ public abstract class Appliance {
             PluginCommand command = this.createPluginCommand(name, plugin);
             command.setExecutor(executor);
             command.setTabCompleter(executor);
+            if(executor.permission() != null) command.setPermission(executor.permission());
             plugin.getServer().getCommandMap().register(plugin.getName(), command);
         } catch(Exception e) {
             throw new RuntimeException(String.format("Failed to register command '%s'", name), e);
diff --git a/core/src/main/java/eu/mhsl/craftattack/spawn/core/appliance/ApplianceCommand.java b/core/src/main/java/eu/mhsl/craftattack/spawn/core/appliance/ApplianceCommand.java
index 0de6055..810b547 100644
--- a/core/src/main/java/eu/mhsl/craftattack/spawn/core/appliance/ApplianceCommand.java
+++ b/core/src/main/java/eu/mhsl/craftattack/spawn/core/appliance/ApplianceCommand.java
@@ -30,6 +30,14 @@ public abstract class ApplianceCommand<T extends Appliance> extends CachedApplia
         this.errorMessage = errorMessage;
     }
 
+    /**
+     * Permission needed to see and run the command. Paper leaves the command out of the command tree
+     * of players without it, so for them it does not exist. Null means everyone.
+     */
+    public @Nullable String permission() {
+        return null;
+    }
+
     @Override
     public boolean onCommand(@NotNull CommandSender sender, @NotNull Command command, @NotNull String label, @NotNull String[] args) {
         try {
diff --git a/core/src/main/resources/config.yml b/core/src/main/resources/config.yml
index 59ca5b2..ae6a280 100644
--- a/core/src/main/resources/config.yml
+++ b/core/src/main/resources/config.yml
@@ -17,6 +17,12 @@ database:
 loginLog:
   retentionMonths: 16
 
+banEvasion:
+  windowDays: 14
+  rejectionWindowHours: 24
+  banCacheMinutes: 5
+  retentionMonths: 16
+
 worldMuseum:
   uuid:
   connect-server-name: worldmuseum