there are a few nice ways to do so: you could use a specialized permission on a flag itself, for global flagging