CB

Keep the top level permission to even access tools, but like other views add permissions to perform the individual tasks. So each task should have its own permission. This way you can have admins use Synchronize Users without having access to the database fix tools.

https://www.joomlapolis.com/forum/255-developer-members-support/228458-can-we-put-an-acl-on-the-cb-tools-menu?start=6