Enumerating permitted commands produces a list that is wrong the moment Redis adds one, and the additions are exactly the commands nobody has considered.
# brittle: a new command is implicitly denied, which is
# sometimes right and is never reviewed
+get +set +del +mget +mset +incr +decr +expire +ttl
# a category, which tracks the server
+@read +@write +@keyspace -@dangerous
> ACL CAT # the categories
> ACL CAT dangerous # what is in one-@dangerous is the single most valuable line: it removes FLUSHALL, KEYS, CONFIG, SHUTDOWN and about thirty others in one clause, and it keeps removing new ones as they are added. Reading ACL CAT dangerous once is educational — several of the commands in there are ones an application has no business calling and most credentials could. Categories and explicit commands compose, so a service can have a category minus one command.