AMI: Add security warnings around AMI Command action

docs/Configuration/Interfaces/Asterisk-Manager-Interface-AMI/AMI-v2-Specification/index.md

@@ -1022,7 +1022,7 @@ Events and actions are automatically classified with particular class authorizat
 | call | The item is associated with calls, i.e., state changes in a call, etc. |
 | log | The item is associated with the logging subsystem |
 | verbose | The item is associated with verbose messages |
-| command | The item is associated with execution of CLI commands through AMI |
+| command | The item is associated with execution of CLI commands through AMI. CLI commands can provide functionality associated with other classes; see [Overlapping Authorizations](#overlapping-authorizations) |
 | agent | The item is associated with Queue Agent manipulation |
 | user | The item is associated with user defined events |
 | config | The item is associated with manipulating the configuration of Asterisk |
@@ -1040,6 +1040,20 @@ Events and actions are automatically classified with particular class authorizat
 | all | The item has all class authorizations associated with it |
 | none | The item has no class authorization associated with it |
 
+#### Overlapping Authorizations
+
+Granting `command` write authorization (including through `write = all`) permits the **Command** action to execute Asterisk CLI commands. These commands can provide functionality similar or equivalent to AMI actions in other classes without requiring those class authorizations. For example:
+
+| CLI command executed through **Command** | Similar AMI action | AMI write authorization for that action |
+| --- | --- | --- |
+| channel originate | Originate | originate |
+| channel request hangup | Hangup | system or call |
+| module reload | Reload | config or system |
+
+Withholding `originate`, `call`, `system`, or `config` does not prevent equivalent operations through **Command**. Grant `command` only to clients trusted to perform the operations exposed by the available CLI commands.
+
+Other classes can overlap as well. For example, **GetConfig** accepts either `system` or `config` write authorization, so withholding `config` alone does not prevent that action.
+
 ### Access Control Lists
 
 Access Control Lists can be used to filter connections based on address. If an attempt to connect from an unauthorized address is detected, the connection attempt will be rejected.

docs/Configuration/Interfaces/Asterisk-Manager-Interface-AMI/The-Asterisk-Manager-TCP-IP-API.md

@@ -11,6 +11,8 @@ AMI receive commands, called "actions". These generate a "response" from Asteris
 
 Management users are configured in the configuration file manager.conf and are given permissions for read and write, where write represents their ability to perform this class of "action", and read represents their ability to receive this class of "event".   
 
+Class permissions can overlap. In particular, the `command` write permission lets a client run CLI commands that can perform similar operations to actions in other classes. See [Class Authorizations](/Configuration/Interfaces/Asterisk-Manager-Interface-AMI/AMI-v2-Specification/#class-authorizations) for details and examples.
+
 If you develop AMI applications, treat the headers in Actions, Events and Responses as local to that particular message. There is no cross-message standardization of headers. 
 
 If you develop applications, please try to reuse existing manager headers and their interpretation. If you are unsure, discuss on the asterisk-dev mailing list.