You could also use CommandHelper to alias it and other /cofh commands to check for certain perms. So for example, grant the "cofh.command.CommandHandler" to everyone then handle individual commands in CH by aliasing them and checking the users group or an arbitrary perm before letting it actually run.