A sudo rule allows the target subcommand (Permission Denied)

Path authorization is correct, but session policy still denies execution. The explicit configuration seems correct, yet an inherited policy no longer resolves the same way under the cleaned hierarchy. Effective ownership looks correct at first glance, but one delegated path still reflects the old hierarchy. Nominal permissions look aligned, yet one delegated control path still reflects the retired operating model. Nominal access still looks aligned, yet one delegated path continues to reflect the previous layered administration model.