Update CLI documentation

docs/cli/opkssh.md

@@ -35,7 +35,8 @@ opkssh [flags]
 * [opkssh client](opkssh_client.md)	 - Interact with client configuration
 * [opkssh inspect](opkssh_inspect.md)	 - Inspect and view details of an opkssh generated SSH key
 * [opkssh login](opkssh_login.md)	 - Authenticate with an OpenID Provider to generate an SSH key for opkssh
+* [opkssh permissions](opkssh_permissions.md)	 - Check and fix filesystem permissions required by opkssh
 * [opkssh readhome](opkssh_readhome.md)	 - Read the principal's home policy file
 * [opkssh verify](opkssh_verify.md)	 - Verify an SSH key (used by sshd AuthorizedKeysCommand)
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_add.md

@@ -36,4 +36,4 @@ opkssh add <principal> <email|sub|group> <issuer> [flags]
 
 * [opkssh](opkssh.md)	 - SSH with OpenPubkey
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_audit.md

@@ -4,7 +4,7 @@ Validate policy file entries against provider definitions
 
 ### Synopsis
 
-Audit validates all entries in /etc/opk/auth_id and ~/.opk/auth_id against the provider definitions in /etc/opk/providers. For complete audit details use the --json flag. Returns a non-zero exit code if any warnings or errors are found.
+Audit validates all entries in the system policy file and user policy files against the provider definitions in the providers file. For complete audit details use the --json flag. Returns a non-zero exit code if any warnings or errors are found.
 
 The audit command checks that:
   - Each issuer in policy files is defined in the providers file
@@ -42,4 +42,4 @@ opkssh audit [flags]
 
 * [opkssh](opkssh.md)	 - SSH with OpenPubkey
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_client.md

@@ -19,4 +19,4 @@ Interact with client configuration
 * [opkssh](opkssh.md)	 - SSH with OpenPubkey
 * [opkssh client provider](opkssh_client_provider.md)	 - Interact with provider configuration
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_client_provider.md

@@ -19,4 +19,4 @@ Interact with provider configuration
 * [opkssh client](opkssh_client.md)	 - Interact with client configuration
 * [opkssh client provider list](opkssh_client_provider_list.md)	 - List configured providers
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_client_provider_list.md

@@ -23,4 +23,4 @@ opkssh client provider list [flags]
 
 * [opkssh client provider](opkssh_client_provider.md)	 - Interact with provider configuration
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_inspect.md

@@ -22,4 +22,4 @@ opkssh inspect <path> [flags]
 
 * [opkssh](opkssh.md)	 - SSH with OpenPubkey
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_login.md

@@ -48,4 +48,4 @@ opkssh login [alias] [flags]
 
 * [opkssh](opkssh.md)	 - SSH with OpenPubkey
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_permissions.md

@@ -0,0 +1,18 @@
+## opkssh permissions
+
+Check and fix filesystem permissions required by opkssh
+
+### Options
+
+```
+  -h, --help   help for permissions
+```
+
+### SEE ALSO
+
+* [opkssh](opkssh.md)	 - SSH with OpenPubkey
+* [opkssh permissions check](opkssh_permissions_check.md)	 - Verify permissions and ownership for opkssh files
+* [opkssh permissions fix](opkssh_permissions_fix.md)	 - Fix permissions and ownership for opkssh files (requires admin)
+* [opkssh permissions install](opkssh_permissions_install.md)	 - Idempotent installer-friendly permissions fix (non-interactive)
+
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_permissions_check.md

@@ -0,0 +1,20 @@
+## opkssh permissions check
+
+Verify permissions and ownership for opkssh files
+
+```
+opkssh permissions check [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for check
+  -j, --json   Output results in JSON
+```
+
+### SEE ALSO
+
+* [opkssh permissions](opkssh_permissions.md)	 - Check and fix filesystem permissions required by opkssh
+
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_permissions_fix.md

@@ -0,0 +1,23 @@
+## opkssh permissions fix
+
+Fix permissions and ownership for opkssh files (requires admin)
+
+```
+opkssh permissions fix [flags]
+```
+
+### Options
+
+```
+      --dry-run   Don't modify anything; show planned changes
+  -h, --help      help for fix
+  -j, --json      Output results in JSON
+  -v, --verbose   Verbose output
+  -y, --yes       Apply changes without confirmation
+```
+
+### SEE ALSO
+
+* [opkssh permissions](opkssh_permissions.md)	 - Check and fix filesystem permissions required by opkssh
+
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_permissions_install.md

@@ -0,0 +1,21 @@
+## opkssh permissions install
+
+Idempotent installer-friendly permissions fix (non-interactive)
+
+```
+opkssh permissions install [flags]
+```
+
+### Options
+
+```
+      --dry-run   Don't modify anything; show planned changes
+  -h, --help      help for install
+  -v, --verbose   Verbose output
+```
+
+### SEE ALSO
+
+* [opkssh permissions](opkssh_permissions.md)	 - Check and fix filesystem permissions required by opkssh
+
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_readhome.md

@@ -29,4 +29,4 @@ opkssh readhome <principal> [flags]
 
 * [opkssh](opkssh.md)	 - SSH with OpenPubkey
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026

docs/cli/opkssh_verify.md

@@ -51,4 +51,4 @@ opkssh verify <principal> <cert> <key_type> [flags]
 
 * [opkssh](opkssh.md)	 - SSH with OpenPubkey
 
-###### Auto generated by spf13/cobra on 21-Jan-2026
+###### Auto generated by spf13/cobra on 23-Mar-2026