If I'm logged on to the console as user, the list of commands I can execute is controlled by access control lists. So, if I'm logged on as a user who has only got the "viewer" role, then I can't shut karaf down, the system:shutdown command requires the "admin" role.
Great. However, I still appear to be able to get command completion that system:shutdown is a command, but when I try and invoke it I get "Command not found: system:shutdown", which seems confusing. Is this intentional? I saw a comment in the code somewhere (lost it now) that made me think that the intention was that only commands I can actually invoke are then put in the completion list, and indeed that would seem like reasonable behaviour.