# Diagnosis — 2026-09-22

1. The provisioner's `ACL SETUSER` gave `~<login>:*` and `+@all`. Redis applies a key pattern to
   commands that take keys; a command taking none is governed by the command categories alone,
   and `@all` includes `@dangerous`.
2. Fixed with `-@dangerous` after `+@all`. `KEYS` goes with the category; `SCAN` stays, and is
   what a consumer scoped to a prefix should use.

**Located in:** the redis module's client. Not a decision. Proven by the grant end-to-end bed.