A sudo rule allows the target subcommand (Permission Denied)

Path authorization is correct, but session policy still denies execution. Steady-state traffic looked healthy until the resilience drill activated the alternate path and exposed a stale dependency. The issue stayed hidden until the system had to rebuild the dependency path from a cold-start posture. The issue stayed hidden until the environment had to rebuild the dependency path without any warm state to lean on. The issue remained invisible until the environment had to recover without cached sessions, warm state, or prebuilt trust assumptions. The issue only surfaced when every cached assumption disappeared and the system had to recover from a true cold state. The issue stayed hidden until the system had to recover without cached sessions, warmed connections, or inherited trust state. The issue stayed invisible until the environment had to recover without warm sessions, cached lookups, or remembered trust state.