Autocompletion of commands currently shows commands to users without the permission to run said commands.

What I mean by this is that normal users still see commands in tab completion that they can't run anyway. This can be solved by adding a permission requirement to the commands themselves.

For example, instead of,
afk:
description: Marks you as away-from-keyboard.
you would have,
afk:
description: Marks you as away-from-keyboard.
permission: essentials.afk

The solution of moving permissions into the plugin.yml would override Essentials permission check system which is not something we want. Essentials could probably do something to the command map to achieve the same effect tho.

Modifying the command map has the same effect as including them in the plugin.yml. EssentialsX already modifies the command list in PlayerCommandSendEvent (and has done so since early 1.13), so if you're seeing commands without the adequate permissions in autocomplete then that's a bug and should be reported as such.

Well, actually I see setPermissionMessage in the Bukkit API so maybe this can be changed at some point. Not sure if there is something else (besides message) that Essentials tries to handle by leaving out permissions... might be worth looking into.

The built-in permissions handling system via the config that Essentials still has might be another reason for that tbh.. That could be worked around by checking if the bukkit permissions are used or not though.

Adding permissions to plugin.yml renders player-commands completely non-functional, as Bukkit prevents EssentialsX handling command execution at all if players lack permissions for the command. While this is a lesser-used feature, it is still used by several small scale servers for convenience and isn't something I'm willing to break. (This would also break EssentialsX's wildcard emulation, though this is irrelevant for most modern permissions plugins so it's less of an issue.)

This issue is not fixed: Essentials commands still do not have their permissions set. (Neither in the plugin.yml nor anywhere in the code via calling Command#setPermission. This results in other plugins not being able to check if the user has permissions for a certain command and might even lead to issues where the command doesn't show up (or shows up) in the command suggestion even though the player does have the permission (or doesn't).

As far as I know, this is done on purpose (for the last 10 years) because Essentials wants to handle the error messages itself. This has presented a bit of a small issue when it comes to autocompletion, but as md mentioned this should already be handled in an alternative way. All command permission nodes are essentials.<command> so it's not really that difficult for other plugins to get, if they really want to.