diff --git a/src/bot.js b/src/bot.js
index cd62494..71d65ee 100644
--- a/src/bot.js
+++ b/src/bot.js
@@ -35,6 +35,10 @@ read().then(() => {
       if (!active)
         continue;
 
+      if (trigger.level > e.user.level.level) {
+        e.reply(`no permission, min level ${trigger.level} required`);
+        break;
+      }
       trigger.f(e);
     }
     logger.info(`${e.network} -> ${e.channel} -> ${e.user.nick}: ${e.message}`);
diff --git a/src/inc/admin.js b/src/inc/admin.js
new file mode 100644
index 0000000..a30a1e6
--- /dev/null
+++ b/src/inc/admin.js
@@ -0,0 +1,40 @@
+import sql from "./sql.js";
+
+export let admins = [];
+export const loadAdmins = (() => {
+  sql.exec("select * from `admins`")
+    .then(rows => {
+      rows.forEach(row => {
+        admins.push({
+          id: row.id,
+          prefix: row.prefix,
+          account: row.account,
+          network: row.network,
+          level: row.level
+        });
+      });
+    })
+    .catch(err => {
+      console.log("keine Admins vorhanden");
+    });
+})();
+
+export const getLevel = (network, user) => {
+  let ret = {
+    level: 0,
+    verified: false
+  };
+  if (typeof user !== "object")
+    return "user has to be an object!";
+  if (!user.account || !user.prefix)
+    return ret;
+  for(let admin of admins) {
+    if (admin.account === user.account.toLowerCase() && admin.network === network.toLowerCase()) {
+      ret = {
+        level: admin.level,
+        verified: user.prefix.toLowerCase() === admin.prefix
+      };
+    }
+  };
+  return ret;
+};
\ No newline at end of file
diff --git a/src/inc/clients/irc.js b/src/inc/clients/irc.js
index f24de5f..2a5d3e4 100644
--- a/src/inc/clients/irc.js
+++ b/src/inc/clients/irc.js
@@ -1,4 +1,6 @@
 import { logger } from "../log.js";
+import { getLevel } from "../admin.js";
+
 const net = require("net")
   , tls = require("tls")
   , EventEmitter = require("events").EventEmitter
@@ -75,7 +77,14 @@ export class irc {
       type: "irc",
       network: this.network,
       channel: tmp.params[0],
-      user: this.parsePrefix(tmp.prefix),
+      user: Object.assign(this.parsePrefix(tmp.prefix), {
+        account: this.server.user.geti(this.parsePrefix(tmp.prefix).nick).account,
+        prefix: tmp.prefix.charAt(0) === ":" ? tmp.prefix.substring(1) : tmp.prefix,
+        level: getLevel(this.network, Object.assign(this.parsePrefix(tmp.prefix), {
+          account: this.server.user.geti(this.parsePrefix(tmp.prefix).nick).account,
+          prefix: tmp.prefix.charAt(0) === ":" ? tmp.prefix.substring(1) : tmp.prefix
+        }))
+      }),
       message: tmp.params[1],
       time: ~~(Date.now() / 1000),
       raw: tmp,
@@ -115,6 +124,7 @@ export class irc {
       hostname: tmpuser.hostname || false,
       realname: tmpuser.realname || false,
       account: tmpuser.account || false,
+      prefix: tmpuser.prefix || false,
       registered: tmpuser.registered || false,
       oper: tmpuser.oper || false,
       channels: tmpuser.channels || [],
diff --git a/src/inc/clients/irc/whois.js b/src/inc/clients/irc/whois.js
index 35c172f..d78a680 100644
--- a/src/inc/clients/irc/whois.js
+++ b/src/inc/clients/irc/whois.js
@@ -16,6 +16,7 @@ module.exports = client => {
     tmpuser.username = msg.params[2];
     tmpuser.hostname = msg.params[3];
     tmpuser.realname = msg.params[5];
+    tmpuser.prefix = `${msg.params[2]}!${msg.params[5]}@${msg.params[3]}`;
     this.server.user.set(msg.params[1], tmpuser);
   }.bind(client));
 
@@ -37,6 +38,7 @@ module.exports = client => {
       hostname: tmpuser.hostname || false,
       realname: tmpuser.realname || false,
       account: tmpuser.account || false,
+      prefix: tmpuser.prefix || false,
       registered: tmpuser.registered || false,
       oper: tmpuser.oper || false,
       channels: tmpuser.channels || [],
diff --git a/src/inc/clients/tg.js b/src/inc/clients/tg.js
index 92d7e10..1c3492c 100644
--- a/src/inc/clients/tg.js
+++ b/src/inc/clients/tg.js
@@ -1,4 +1,6 @@
 import { logger } from "../log.js";
+import { getLevel } from "../admin.js";
+
 const tgapi = require("node-telegram-bot-api")
   , EventEmitter = require("events").EventEmitter
   , util = require("util");
@@ -21,6 +23,8 @@ export class tg {
         this.server.user.set(msg.from.username || msg.from.first_name, {
           nick: msg.from.first_name,
           username: msg.from.username,
+          account: msg.from.id.toString(),
+          prefix: `${msg.from.username}!${msg.from.id.toString()}`,
           id: msg.from.id
         });
 
@@ -38,9 +42,16 @@ export class tg {
       channel: tmp.chat.title,
       channelid: tmp.chat.id,
       user: {
+        prefix: `${tmp.from.username}!${tmp.from.id}`,
         nick: tmp.from.first_name,
         username: tmp.from.username,
-        hostname: tmp.from.id
+        account: tmp.from.id.toString(),
+        level: getLevel("Telegram", {
+          prefix: `${tmp.from.username}!${tmp.from.id}`,
+          nick: tmp.from.first_name,
+          username: tmp.from.username,
+          account: tmp.from.id.toString()
+        })
       },
       message: tmp.text,
       time: tmp.date,
diff --git a/src/inc/trigger/debug.js b/src/inc/trigger/debug.js
index 8976028..af0e424 100644
--- a/src/inc/trigger/debug.js
+++ b/src/inc/trigger/debug.js
@@ -1,36 +1,38 @@
+import { admins, getLevel } from "../admin.js";
+
 const vm = require("vm");
 
 let maxoutput = 500;
 let context = vm.createContext({
   e: null,
-  bot: null
+  bot: null,
+  admins: null,
 });
 module.exports = bot => {
   bot._trigger.set("sandbox_debug", {
     call: /^\!debug (.*)/i,
-    level: 0,
+    level: 100,
     active: true,
     clients: ["irc", "tg"],
     f: e => {
       const args = e.message.trim().substring(7);
-      if ((e.user.nick === "Flummi" && e.network === "n0xy")
-        || (e.user.nick === "belst" && e.network === "n0xy")
-        || (e.user.nick === "jkhsjdhjs" && e.network === "n0xy")
-      ) {
-        try {
-          let output = vm.runInContext(args, context);
-          if (typeof output !== undefined && output) {
-            output = JSON.stringify(output);
-            if (output.length > maxoutput)
-              return e.reply(`holy fuck, Ausgabe wäre viel zu lang! (${output.length} Zeichen :DDDDDD)`);
-            else
-              e.reply(output);
-          }
-        }
-        catch (err) {
-          e.reply(err.message);
+      try {
+        context.admins = admins;
+        context.e = e;
+        context.bot = bot;
+        context.level = getLevel;
+        let output = vm.runInContext(args, vm.createContext(context));
+        if (typeof output !== undefined && output) {
+          output = JSON.stringify(output);
+          if (output.length > maxoutput)
+            return e.reply(`holy fuck, Ausgabe wäre viel zu lang! (${output.length} Zeichen :DDDDDD)`);
+          else
+            e.reply(output);
         }
       }
+      catch (err) {
+        e.reply(err.message);
+      }
     }
   });
 };
\ No newline at end of file
diff --git a/src/inc/trigger/sandbox.js b/src/inc/trigger/sandbox.js
index 01e73be..8c3a207 100644
--- a/src/inc/trigger/sandbox.js
+++ b/src/inc/trigger/sandbox.js
@@ -55,7 +55,7 @@ module.exports = bot => {
 
   bot._trigger.set("sandbox", {
     call: /^\!(hs|py|cpp|bf|php|lua|bash) .*/i,
-    level: 100,
+    level: 0,
     active: true,
     clients: ["irc", "tg"],
     f: e => {
@@ -72,7 +72,7 @@ module.exports = bot => {
 
   bot._trigger.set("sandbox_rs", {
     call: /^\!rs (.*)/i,
-    level: 100,
+    level: 0,
     active: true,
     clients: ["irc", "tg"],
     f: e => {
@@ -102,7 +102,7 @@ module.exports = bot => {
 
   bot._trigger.set("bfgen", {
     call: /^\!bfgen .*/i,
-    level: 100,
+    level: 0,
     active: true,
     clients: ["irc", "tg"],
     f: e => {