docs(auth): clarify CLI permission scope

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/access-control.mdx

@@ -173,7 +173,7 @@ The **Chat Deployment** row also carries an **auth-mode allowlist** — *Auth mo
 | API Keys | Revokes workspace API keys. Members cannot list, create, or revoke one. |
 | Personal API Keys | Prevents members from using a personal API key against this workspace. |
 | Personal Credentials | Prevents connecting personal credentials, leaving only workspace-shared ones. |
-| CLI Access | Prevents approving or using a CLI login for the public API. |
+| CLI Access | Prevents approving a CLI login or using Sim CLI OAuth tokens for the public API. Existing API keys retain their own restrictions. |
 | OAuth App Access | Prevents OAuth apps from accessing the group's workspaces. The organization default group also governs authorization, token issuance and refresh, and account-level billing and audit reads. |
 
 ##### Rows read from the organization default group

apps/sim/lib/permission-groups/fields.ts

@@ -464,7 +464,7 @@ export const PERMISSION_GROUP_FIELDS = {
     id: 'disable-cli-access',
     label: 'CLI Access',
     category: 'Credentials & Access',
-    hint: "Prevent approving or using a CLI login for the public API. A login naming one of this group's workspaces is refused; an account-level login names none, so it is read from the organization's default group.",
+    hint: "Prevent approving a CLI login or using Sim CLI OAuth tokens for the public API. A login naming one of this group's workspaces is refused; an account-level login names none, so it is read from the organization's default group.",
   }),
   disableWebhookTriggers: booleanRestriction('capability', {
     scope: 'workspace',