diff --git a/README.md b/README.md
index e249636..96ff8ef 100644
--- a/README.md
+++ b/README.md
@@ -190,7 +190,7 @@ This module is for interacting with the room that the commands are being execute
 * !room banned                                      Lists the banned users and their provided reason
 * !room kicked                                      Lists the kicked users and their provided reason
 * !room state [event type] [optional state key]     Gets a state event with given event type and optional state key
-* !room tombstone [target]                          Creates a tombstone event pointing to target room. Target room can be alias (starting with #) or id (starting with !).
+* !room tombstone [target]                          Creates a tombstone event pointing to target room. Target room can be alias (starting with #) or id (starting with !). User must be admin in the room.
 
 Note on tombstone: If using alias, bot must be present in target room. This is the preferred way. If using id, make sure it's correct, as it's not validated!
 Tombstoning requires power level for room upgrade. Make sure bot has it in the room.
@@ -614,8 +614,8 @@ Admin commands to manage users.
 
 #### Usage
 
-* !users list [pattern]  - List users matching wildcard pattern
-* !users kick [pattern]  - Kick users matching wildcard pattern from room
+* !users list [pattern]  - List users matching wildcard pattern (must be owner)
+* !users kick [pattern]  - Kick users matching wildcard pattern from room (must be admin in room)
 
 ## Bot setup
 
diff --git a/modules/users.py b/modules/users.py
index 0648ffb..81a101a 100644
--- a/modules/users.py
+++ b/modules/users.py
@@ -8,6 +8,7 @@ class MatrixModule(BotModule):
 
         if len(args) == 2:
             if args[0] == 'list':
+                bot.must_be_owner(event)
                 users = self.search_users(bot, args[1])
                 if len(users):
                     await bot.send_text(room, ' '.join(users))
@@ -15,6 +16,7 @@ class MatrixModule(BotModule):
                     await bot.send_text(room, 'No matching users found!')
                 return
             if args[0] == 'kick':
+                bot.must_be_admin(room, event)
                 users = self.search_users(bot, args[1])
                 if len(users):
                     for user in users: