diff --git a/cli/commands/publish.ts b/cli/commands/publish.ts
index 97099fd..67b4c5f 100644
--- a/cli/commands/publish.ts
+++ b/cli/commands/publish.ts
@@ -2,6 +2,7 @@ import { Colors, Path, FS, Compress, Base64 } from "../deps.ts";
 import { getMeta, IMeta, log, getConfig } from "../global.ts";
 import { runHooks } from "../helper/run_script.ts";
 import { ServerError } from "../helper/server_error.ts";
+import { checkPermOrExit } from "../helper/permission.ts";
 
 export default async function publish(options: { dry: boolean }) {
    const originalMeta = await getMeta();
@@ -62,6 +63,8 @@ export default async function publish(options: { dry: boolean }) {
       );
 
       if (!options.dry) {
+         await checkPermOrExit("net", "Net permission required for publishing");
+
          log("Uploading new package version");
          await fetch(url, {
             method: "POST",
diff --git a/cli/commands/upgrade.ts b/cli/commands/upgrade.ts
index d1d18f9..896cb9c 100644
--- a/cli/commands/upgrade.ts
+++ b/cli/commands/upgrade.ts
@@ -1,7 +1,12 @@
 import { Cliffy, Colors } from "../deps.ts";
 import { version } from "../version.ts";
+import { requestPermOrExit } from "../helper/permission.ts";
 
 export default async function upgrade() {
+   await requestPermOrExit(
+      "net",
+      "Net permission required to fetch new version"
+   );
    const meta = await fetch(
       "https://deno.hibas123.de/raw/@denreg-cli/meta.json"
    ).then((e) => e.json());
@@ -20,15 +25,23 @@ export default async function upgrade() {
    });
 
    if (res) {
+      const cmd = [
+         "deno",
+         "install",
+         "-A",
+         "--unstable",
+         "-f",
+         `https://deno.hibas123.de/raw/@denreg-cli@${meta.version}/denreg.ts`,
+      ];
+
+      await requestPermOrExit(
+         "run",
+         "Run permission required to install new version. Or run it manually: " +
+            cmd.join(" ")
+      );
+
       const process = Deno.run({
-         cmd: [
-            "deno",
-            "install",
-            "-A",
-            "--unstable",
-            "-f",
-            `https://deno.hibas123.de/raw/@denreg-cli@${meta.version}/denreg.ts`,
-         ],
+         cmd,
       });
 
       const s = await process.status();
diff --git a/cli/denreg.ts b/cli/denreg.ts
index d01b21e..8a4e2ae 100644
--- a/cli/denreg.ts
+++ b/cli/denreg.ts
@@ -1,8 +1,13 @@
 import { Cliffy, Path, Colors } from "./deps.ts";
+
+import { checkPermOrExit } from "./helper/permission.ts";
+
+await checkPermOrExit("env", "Requires --allow-env");
+await checkPermOrExit("read", "Requires --allow-read");
+await checkPermOrExit("write", "Requires --allow-write");
+
 import { init } from "./global.ts";
-
 import { version } from "./version.ts";
-
 import setupCMD from "./commands/setup.ts";
 import initCMD from "./commands/init.ts";
 import bumpCMD from "./commands/bump.ts";
diff --git a/cli/helper/permission.ts b/cli/helper/permission.ts
new file mode 100644
index 0000000..d7bd4be
--- /dev/null
+++ b/cli/helper/permission.ts
@@ -0,0 +1,26 @@
+import { Colors } from "../deps.ts";
+
+export const checkPermOrExit = (name: string, err: string) =>
+   Deno.permissions.query({ name: name as any }).then((res) => {
+      if (res.state !== "granted") {
+         console.log(Colors.bold(Colors.red(err)));
+         Deno.exit(1);
+      }
+   });
+
+export const requestPermOrExit = (name: string, err: string) => {
+   Deno.permissions
+      .query({ name: name as any })
+      .then((res) => {
+         if (res.state === "prompt") {
+            return Deno.permissions.request({ name: name as any });
+         }
+         return res;
+      })
+      .then((res) => {
+         if (res.state !== "granted") {
+            console.log(Colors.bold(Colors.red(err)));
+            Deno.exit(1);
+         }
+      });
+};
diff --git a/cli/helper/run_script.ts b/cli/helper/run_script.ts
index 0d42804..13a1949 100644
--- a/cli/helper/run_script.ts
+++ b/cli/helper/run_script.ts
@@ -1,6 +1,11 @@
 import { Colors } from "../deps.ts";
+import { checkPermOrExit } from "../helper/permission.ts";
 
 export async function runScript(script: string) {
+   await checkPermOrExit(
+      "run",
+      "Requires --allow-run to run scripts and hooks"
+   );
    console.log(Colors.bold(Colors.blue("Running script:")), script);
    const runPerm = await Deno.permissions.query({
       name: "run",
diff --git a/cli/meta.json b/cli/meta.json
index 53d85e8..7a3a969 100644
--- a/cli/meta.json
+++ b/cli/meta.json
@@ -1,6 +1,6 @@
 {
    "name": "@denreg-cli",
-   "version": "0.3.0",
+   "version": "0.3.2",
    "description": "CLI for the DenReg package registry",
    "author": "Fabian Stamm <dev@fabianstamm.de>",
    "contributors": [],
diff --git a/cli/test.ts b/cli/test.ts
new file mode 100644
index 0000000..e69de29
diff --git a/cli/version.ts b/cli/version.ts
index 9bb0956..9df321f 100644
--- a/cli/version.ts
+++ b/cli/version.ts
@@ -1 +1 @@
-export const version = "0.3.0"
\ No newline at end of file
+export const version = "0.3.2"
\ No newline at end of file