The reset-apikey command has its own auth mechanism via --acc-mgr-token, so it should not be gated by permission introspection. This matches the behavior of "user create" which is also Permitted: true. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>