Redis ACL Key-Pattern Restrictions and Keyspace-Wide Command Behavior

Least-Privilege Scope with Redis ACLs

Redis 6.0 and later support Access Control Lists that restrict a user to specific key patterns with the ~ prefix alongside granular command permissions. When designing a least-privilege account, I want to confine an application user to a single namespace such as ~cache:* while still allowing ordinary read and write commands.

The uncertainty is how key-pattern rules interact with commands that are not scoped to one key. Commands like SCAN, KEYS, DBSIZE, or multi-key operations may touch keys outside the granted pattern, and it is not obvious from the rule syntax alone whether the pattern filter is applied consistently across all of them.

Specifically:

• Does a key-pattern restriction filter the output of keyspace-wide commands such as SCAN and KEYS, or must those commands be denied separately?
• Can a user holding a broad command category (for example +@read) still reach keys outside its ~pattern through any command in that category?
• Is there a documented way to confirm with ACL LIST or a test command that the effective permissions match the intended least-privilege scope?