Specifically observed with the /add command when trying to add a user with a flag that you don't have permission to. The command processor expects each restriction to specify an error message to be used when it is violated, but none are defined for this command. Other commands also likely lack these elements.
My suggestions:
- Have a generic "access denied" message sent when commands.xml does not define its own message.
- Allow a command to define a single error message to cover all of its restrictions.