[CLI] Friendly errors when API actions are denied by policy

[kaiju]

When API actions are denied by the set policy, we should express a friendly error to the end user/agent/etc in where those permissions can be modified.