diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb937101f..c92132bdd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,14 +13,25 @@ All of these changes are from [PR
   and `ResponseBody()`, resources simply expose `Response()`. This higher-level
   response object contains the map and body, and also exposes `StatusCode()` in
   place of indivdidual resources.
+  [PR](https://github.com/hashicorp/boundary/pull/962)
 * cli: In `json` output format, a resource item is now an object under the
   top-level key `item`; a list of resource items is now an list of objects under
   the top-level key `items`. This preserves the top level for putting in other
   useful information later on (and the HTTP status code is included now).
+  [PR](https://github.com/hashicorp/boundary/pull/962)
 * cli: In `json` output format, errors are now serialized as a JSON object with
   an `error` key instead of outputting normal text
+  [PR](https://github.com/hashicorp/boundary/pull/962)
 * cli: All errors, including API errors, are now written to `stderr`. Previously
   in the default table format, API errors would be written to `stdout`.
+  [PR](https://github.com/hashicorp/boundary/pull/962)
+* cli: Error return codes have been standardized across CLI commands. An error
+  code of `1` indicates an error generated from the actual controller API; an
+  error code of `2` is an error encountered due to the CLI command's logic; and
+  an error code of `3` indicates an error that was caused due to user input to
+  the command. (There is some nuance sometimes whether an error is really due to
+  user input or not, but we attempt to be consistent.)
+  [PR](https://github.com/hashicorp/boundary/pull/976)
 
 ### New and Improved
 
diff --git a/internal/cmd/base/base.go b/internal/cmd/base/base.go
index 9d9b46c91..3df7a6174 100644
--- a/internal/cmd/base/base.go
+++ b/internal/cmd/base/base.go
@@ -27,6 +27,13 @@ import (
 	zkeyring "github.com/zalando/go-keyring"
 )
 
+const (
+	CommandSuccess int = iota
+	CommandApiError
+	CommandCliError
+	CommandUserError
+)
+
 const (
 	// maxLineLength is the maximum width of any line.
 	maxLineLength int = 78
diff --git a/internal/cmd/base/format.go b/internal/cmd/base/format.go
index bd070d23e..fb7b02c8d 100644
--- a/internal/cmd/base/format.go
+++ b/internal/cmd/base/format.go
@@ -229,7 +229,7 @@ func (c *Command) PrintCliError(err error) {
 }
 
 // PrintJsonItem prints the given item to the UI in JSON format
-func (c *Command) PrintJsonItem(result api.GenericResult, item interface{}) int {
+func (c *Command) PrintJsonItem(result api.GenericResult, item interface{}) bool {
 	output := struct {
 		StatusCode int         `json:"status_code"`
 		Item       interface{} `json:"item"`
@@ -240,14 +240,14 @@ func (c *Command) PrintJsonItem(result api.GenericResult, item interface{}) int
 	b, err := JsonFormatter{}.Format(output)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return false
 	}
 	c.UI.Output(string(b))
-	return 0
+	return true
 }
 
 // PrintJsonItems prints the given items to the UI in JSON format
-func (c *Command) PrintJsonItems(result api.GenericListResult, items []interface{}) int {
+func (c *Command) PrintJsonItems(result api.GenericListResult, items []interface{}) bool {
 	output := struct {
 		StatusCode int           `json:"status_code"`
 		Items      []interface{} `json:"items"`
@@ -258,10 +258,10 @@ func (c *Command) PrintJsonItems(result api.GenericListResult, items []interface
 	b, err := JsonFormatter{}.Format(output)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return false
 	}
 	c.UI.Output(string(b))
-	return 0
+	return true
 }
 
 // An output formatter for json output of an object
diff --git a/internal/cmd/commands/accountscmd/accounts.gen.go b/internal/cmd/commands/accountscmd/accounts.gen.go
index a51863ac8..8f52205a4 100644
--- a/internal/cmd/commands/accountscmd/accounts.gen.go
+++ b/internal/cmd/commands/accountscmd/accounts.gen.go
@@ -133,12 +133,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []accounts.Option
@@ -148,7 +148,7 @@ func (c *Command) Run(args []string) int {
 		case "list":
 			if c.FlagAuthMethodId == "" {
 				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -156,7 +156,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	accountsClient := accounts.NewClient(client)
 
@@ -202,8 +202,8 @@ func (c *Command) Run(args []string) int {
 
 	}
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -234,19 +234,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -267,7 +267,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*accounts.Account)
@@ -283,14 +283,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -300,10 +302,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -312,7 +316,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]accounts.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]accounts.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *accounts.Client, _ uint32, _ []accounts.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/accountscmd/funcs.go b/internal/cmd/commands/accountscmd/funcs.go
index 3c505bbbb..aa1d371f2 100644
--- a/internal/cmd/commands/accountscmd/funcs.go
+++ b/internal/cmd/commands/accountscmd/funcs.go
@@ -115,25 +115,25 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 	}
 }
 
-func extraFlagsHandlingFuncImpl(c *Command, opts *[]accounts.Option) int {
+func extraFlagsHandlingFuncImpl(c *Command, opts *[]accounts.Option) bool {
 	if strutil.StrListContains(flagsMap[c.Func], "password") && c.flagPassword == "" {
 		fmt.Print("Password is not set as flag, please enter it now (will be hidden): ")
 		value, err := password.Read(os.Stdin)
 		fmt.Print("\n")
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("An error occurred attempting to read the password. The raw error message is shown below but usually this is because you attempted to pipe a value into the command or you are executing outside of a terminal (TTY). The raw error was:\n\n%s", err.Error()))
-			return 2
+			return false
 		}
 		fmt.Print("Please enter it one more time for confirmation: ")
 		confirmation, err := password.Read(os.Stdin)
 		fmt.Print("\n")
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("An error occurred attempting to read the password. The raw error message is shown below but usually this is because you attempted to pipe a value into the command or you are executing outside of a terminal (TTY). The raw error was:\n\n%s", err.Error()))
-			return 2
+			return false
 		}
 		if strings.TrimSpace(value) != strings.TrimSpace(confirmation) {
 			c.UI.Error("Entered password and confirmation value did not match.")
-			return 2
+			return false
 		}
 		c.flagPassword = strings.TrimSpace(value)
 	}
@@ -144,18 +144,18 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]accounts.Option) int {
 		fmt.Print("\n")
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("An error occurred attempting to read the password. The raw error message is shown below but usually this is because you attempted to pipe a value into the command or you are executing outside of a terminal (TTY). The raw error was:\n\n%s", err.Error()))
-			return 2
+			return false
 		}
 		fmt.Print("Please enter it one more time for confirmation: ")
 		confirmation, err := password.Read(os.Stdin)
 		fmt.Print("\n")
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("An error occurred attempting to read the password. The raw error message is shown below but usually this is because you attempted to pipe a value into the command or you are executing outside of a terminal (TTY). The raw error was:\n\n%s", err.Error()))
-			return 2
+			return false
 		}
 		if strings.TrimSpace(value) != strings.TrimSpace(confirmation) {
 			c.UI.Error("Entered password and confirmation value did not match.")
-			return 2
+			return false
 		}
 		c.flagCurrentPassword = strings.TrimSpace(value)
 	}
@@ -166,12 +166,12 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]accounts.Option) int {
 		fmt.Print("\n")
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("An error occurred attempting to read the password. The raw error message is shown below but usually this is because you attempted to pipe a value into the command or you are executing outside of a terminal (TTY). The raw error was:\n\n%s", err.Error()))
-			return 2
+			return false
 		}
 		c.flagNewPassword = strings.TrimSpace(value)
 	}
 
-	return 0
+	return true
 }
 
 func executeExtraActionsImpl(c *Command, origResult api.GenericResult, origError error, accountClient *accounts.Client, version uint32, opts []accounts.Option) (api.GenericResult, error) {
diff --git a/internal/cmd/commands/accountscmd/password_accounts.gen.go b/internal/cmd/commands/accountscmd/password_accounts.gen.go
index e17f796c0..8dbb9c99a 100644
--- a/internal/cmd/commands/accountscmd/password_accounts.gen.go
+++ b/internal/cmd/commands/accountscmd/password_accounts.gen.go
@@ -116,12 +116,12 @@ func (c *PasswordCommand) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsPasswordMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []accounts.Option
@@ -131,7 +131,7 @@ func (c *PasswordCommand) Run(args []string) int {
 		case "create":
 			if c.FlagAuthMethodId == "" {
 				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -139,7 +139,7 @@ func (c *PasswordCommand) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	accountsClient := accounts.NewClient(client)
 
@@ -175,8 +175,8 @@ func (c *PasswordCommand) Run(args []string) int {
 		}
 	}
 
-	if ret := extraPasswordFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraPasswordFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	var result api.GenericResult
@@ -196,19 +196,19 @@ func (c *PasswordCommand) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomPasswordActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -220,17 +220,19 @@ func (c *PasswordCommand) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
 	extraPasswordActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraPasswordSynopsisFunc        = func(*PasswordCommand) string { return "" }
 	extraPasswordFlagsFunc           = func(*PasswordCommand, *base.FlagSets, *base.FlagSet) {}
-	extraPasswordFlagsHandlingFunc   = func(*PasswordCommand, *[]accounts.Option) int { return 0 }
+	extraPasswordFlagsHandlingFunc   = func(*PasswordCommand, *[]accounts.Option) bool { return true }
 	executeExtraPasswordActions      = func(_ *PasswordCommand, inResult api.GenericResult, inErr error, _ *accounts.Client, _ uint32, _ []accounts.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/accountscmd/password_funcs.go b/internal/cmd/commands/accountscmd/password_funcs.go
index 3359063fd..0df7f8890 100644
--- a/internal/cmd/commands/accountscmd/password_funcs.go
+++ b/internal/cmd/commands/accountscmd/password_funcs.go
@@ -78,10 +78,10 @@ func extraPasswordFlagsFuncImpl(c *PasswordCommand, set *base.FlagSets, f *base.
 	}
 }
 
-func extraPasswordFlagsHandlingFuncImpl(c *PasswordCommand, opts *[]accounts.Option) int {
+func extraPasswordFlagsHandlingFuncImpl(c *PasswordCommand, opts *[]accounts.Option) bool {
 	if c.Func == "create" && c.flagLoginName == "" {
 		c.UI.Error("Login Name must be passed in via -login-name")
-		return 1
+		return false
 	}
 
 	switch c.flagLoginName {
@@ -100,18 +100,18 @@ func extraPasswordFlagsHandlingFuncImpl(c *PasswordCommand, opts *[]accounts.Opt
 			fmt.Print("\n")
 			if err != nil {
 				c.UI.Error(fmt.Sprintf("An error occurred attempting to read the password. The raw error message is shown below but usually this is because you attempted to pipe a value into the command or you are executing outside of a terminal (TTY). The raw error was:\n\n%s", err.Error()))
-				return 2
+				return false
 			}
 			fmt.Print("Please enter it one more time for confirmation: ")
 			confirmation, err := password.Read(os.Stdin)
 			fmt.Print("\n")
 			if err != nil {
 				c.UI.Error(fmt.Sprintf("An error occurred attempting to read the password. The raw error message is shown below but usually this is because you attempted to pipe a value into the command or you are executing outside of a terminal (TTY). The raw error was:\n\n%s", err.Error()))
-				return 2
+				return false
 			}
 			if strings.TrimSpace(value) != strings.TrimSpace(confirmation) {
 				c.UI.Error("Entered password and confirmation value did not match.")
-				return 2
+				return false
 			}
 			*opts = append(*opts, accounts.WithPasswordAccountPassword(strings.TrimSpace(value)))
 		default:
@@ -119,5 +119,5 @@ func extraPasswordFlagsHandlingFuncImpl(c *PasswordCommand, opts *[]accounts.Opt
 		}
 	}
 
-	return 0
+	return true
 }
diff --git a/internal/cmd/commands/authenticate/password.go b/internal/cmd/commands/authenticate/password.go
index 2eab0a2c4..444ff4d71 100644
--- a/internal/cmd/commands/authenticate/password.go
+++ b/internal/cmd/commands/authenticate/password.go
@@ -96,16 +96,16 @@ func (c *PasswordCommand) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	switch {
 	case c.flagLoginName == "":
 		c.PrintCliError(errors.New("Login name must be provided via -login-name"))
-		return 1
+		return base.CommandUserError
 	case c.FlagAuthMethodId == "":
 		c.PrintCliError(errors.New("Auth method ID must be provided via -auth-method-id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	if c.flagPassword == "" {
@@ -114,7 +114,7 @@ func (c *PasswordCommand) Run(args []string) int {
 		fmt.Print("\n")
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("An error occurred attempting to read the password. The raw error message is shown below but usually this is because you attempted to pipe a value into the command or you are executing outside of a terminal (TTY). The raw error was:\n\n%s", err.Error()))
-			return 2
+			return base.CommandUserError
 		}
 		c.flagPassword = strings.TrimSpace(value)
 	}
@@ -122,7 +122,7 @@ func (c *PasswordCommand) Run(args []string) int {
 	client, err := c.Client(base.WithNoTokenScope(), base.WithNoTokenValue())
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %w", err))
-		return 2
+		return base.CommandCliError
 	}
 
 	// note: Authenticate() calls SetToken() under the hood to set the
@@ -136,10 +136,10 @@ func (c *PasswordCommand) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, "Error from controller when performing authentication")
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to perform authentication: %w", err))
-		return 2
+		return base.CommandCliError
 	}
 
 	token := result.GetItem().(*authtokens.AuthToken)
@@ -156,7 +156,10 @@ func (c *PasswordCommand) Run(args []string) int {
 		}))
 
 	case "json":
-		return c.PrintJsonItem(result, token)
+		if ok := c.PrintJsonItem(result, token); !ok {
+			return base.CommandCliError
+		}
+		return base.CommandSuccess
 	}
 
 	var gotErr bool
@@ -210,5 +213,5 @@ func (c *PasswordCommand) Run(args []string) int {
 		c.UI.Warn("The token printed above must be manually passed in via the BOUNDARY_TOKEN env var or -token flag. Storing the token can also be disabled via -keyring-type=none.")
 	}
 
-	return 0
+	return base.CommandSuccess
 }
diff --git a/internal/cmd/commands/authmethodscmd/authmethods.gen.go b/internal/cmd/commands/authmethodscmd/authmethods.gen.go
index f2ae52299..a17e3af3d 100644
--- a/internal/cmd/commands/authmethodscmd/authmethods.gen.go
+++ b/internal/cmd/commands/authmethodscmd/authmethods.gen.go
@@ -131,12 +131,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []authmethods.Option
@@ -146,7 +146,7 @@ func (c *Command) Run(args []string) int {
 		case "list":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -154,7 +154,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	authmethodsClient := authmethods.NewClient(client)
 
@@ -169,8 +169,8 @@ func (c *Command) Run(args []string) int {
 
 	var version uint32
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -201,19 +201,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -234,7 +234,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*authmethods.AuthMethod)
@@ -250,14 +250,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -267,10 +269,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -279,7 +283,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]authmethods.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]authmethods.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *authmethods.Client, _ uint32, _ []authmethods.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/authmethodscmd/password_authmethods.gen.go b/internal/cmd/commands/authmethodscmd/password_authmethods.gen.go
index 5bc6f2949..a9e980368 100644
--- a/internal/cmd/commands/authmethodscmd/password_authmethods.gen.go
+++ b/internal/cmd/commands/authmethodscmd/password_authmethods.gen.go
@@ -116,12 +116,12 @@ func (c *PasswordCommand) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsPasswordMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []authmethods.Option
@@ -131,7 +131,7 @@ func (c *PasswordCommand) Run(args []string) int {
 		case "create":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -139,7 +139,7 @@ func (c *PasswordCommand) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	authmethodsClient := authmethods.NewClient(client)
 
@@ -180,8 +180,8 @@ func (c *PasswordCommand) Run(args []string) int {
 		}
 	}
 
-	if ret := extraPasswordFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraPasswordFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	var result api.GenericResult
@@ -201,19 +201,19 @@ func (c *PasswordCommand) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomPasswordActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -225,17 +225,19 @@ func (c *PasswordCommand) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
 	extraPasswordActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraPasswordSynopsisFunc        = func(*PasswordCommand) string { return "" }
 	extraPasswordFlagsFunc           = func(*PasswordCommand, *base.FlagSets, *base.FlagSet) {}
-	extraPasswordFlagsHandlingFunc   = func(*PasswordCommand, *[]authmethods.Option) int { return 0 }
+	extraPasswordFlagsHandlingFunc   = func(*PasswordCommand, *[]authmethods.Option) bool { return true }
 	executeExtraPasswordActions      = func(_ *PasswordCommand, inResult api.GenericResult, inErr error, _ *authmethods.Client, _ uint32, _ []authmethods.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/authmethodscmd/password_funcs.go b/internal/cmd/commands/authmethodscmd/password_funcs.go
index abd46c19e..b9f917297 100644
--- a/internal/cmd/commands/authmethodscmd/password_funcs.go
+++ b/internal/cmd/commands/authmethodscmd/password_funcs.go
@@ -75,7 +75,7 @@ func extraPasswordFlagsFuncImpl(c *PasswordCommand, set *base.FlagSets, f *base.
 	}
 }
 
-func extraPasswordFlagHandlingFuncImpl(c *PasswordCommand, opts *[]authmethods.Option) int {
+func extraPasswordFlagHandlingFuncImpl(c *PasswordCommand, opts *[]authmethods.Option) bool {
 	var attributes map[string]interface{}
 	addAttribute := func(name string, value interface{}) {
 		if attributes == nil {
@@ -91,7 +91,7 @@ func extraPasswordFlagHandlingFuncImpl(c *PasswordCommand, opts *[]authmethods.O
 		length, err := strconv.ParseUint(c.flagMinLoginNameLength, 10, 32)
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("Error parsing %q: %s", c.flagMinLoginNameLength, err))
-			return 1
+			return false
 		}
 		addAttribute("min_login_name_length", uint32(length))
 	}
@@ -104,7 +104,7 @@ func extraPasswordFlagHandlingFuncImpl(c *PasswordCommand, opts *[]authmethods.O
 		length, err := strconv.ParseUint(c.flagMinPasswordLength, 10, 32)
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("Error parsing %q: %s", c.flagMinPasswordLength, err))
-			return 1
+			return false
 		}
 		addAttribute("min_password_length", uint32(length))
 	}
@@ -113,5 +113,5 @@ func extraPasswordFlagHandlingFuncImpl(c *PasswordCommand, opts *[]authmethods.O
 		*opts = append(*opts, authmethods.WithAttributes(attributes))
 	}
 
-	return 0
+	return true
 }
diff --git a/internal/cmd/commands/authtokenscmd/authtokens.gen.go b/internal/cmd/commands/authtokenscmd/authtokens.gen.go
index c8dafcf2a..204d36f08 100644
--- a/internal/cmd/commands/authtokenscmd/authtokens.gen.go
+++ b/internal/cmd/commands/authtokenscmd/authtokens.gen.go
@@ -127,12 +127,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []authtokens.Option
@@ -142,7 +142,7 @@ func (c *Command) Run(args []string) int {
 		case "list":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -150,7 +150,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	authtokensClient := authtokens.NewClient(client)
 
@@ -165,8 +165,8 @@ func (c *Command) Run(args []string) int {
 
 	var version uint32
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -197,19 +197,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -230,7 +230,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*authtokens.AuthToken)
@@ -246,14 +246,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -263,10 +265,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -275,7 +279,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]authtokens.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]authtokens.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *authtokens.Client, _ uint32, _ []authtokens.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/config/autocomplete.go b/internal/cmd/commands/config/autocomplete.go
index 25e41ea02..32f361580 100644
--- a/internal/cmd/commands/config/autocomplete.go
+++ b/internal/cmd/commands/config/autocomplete.go
@@ -54,5 +54,5 @@ func (c *AutocompleteCommand) Run(args []string) int {
 	if len(args) > 0 {
 		return cli.RunResultHelp
 	}
-	return 0
+	return base.CommandSuccess
 }
diff --git a/internal/cmd/commands/config/encryptdecrypt.go b/internal/cmd/commands/config/encryptdecrypt.go
index 28c7a09c2..c38270929 100644
--- a/internal/cmd/commands/config/encryptdecrypt.go
+++ b/internal/cmd/commands/config/encryptdecrypt.go
@@ -124,13 +124,13 @@ func (c *EncryptDecryptCommand) Run(args []string) (ret int) {
 	f := c.Flags()
 	if err := f.Parse(args); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	switch c.flagConfig {
 	case "":
 		c.UI.Error(`Missing required parameter -config`)
-		return 1
+		return base.CommandUserError
 	default:
 		c.flagConfig = strings.TrimSpace(c.flagConfig)
 	}
@@ -146,16 +146,16 @@ func (c *EncryptDecryptCommand) Run(args []string) (ret int) {
 	wrapper, err := wrapper.GetWrapperFromPath(kmsDefFile, "config")
 	if err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 	if wrapper == nil {
 		c.UI.Error(`No wrapper with "config" purpose found"`)
-		return 1
+		return base.CommandUserError
 	}
 
 	if err := wrapper.Init(c.Context); err != nil {
 		c.UI.Error(fmt.Errorf("Error initializing KMS: %w", err).Error())
-		return 1
+		return base.CommandUserError
 	}
 	defer func() {
 		if err := wrapper.Finalize(c.Context); err != nil {
@@ -166,7 +166,7 @@ func (c *EncryptDecryptCommand) Run(args []string) (ret int) {
 	d, err := ioutil.ReadFile(c.flagConfig)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error reading config file: %w", err).Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	raw := string(d)
@@ -174,31 +174,31 @@ func (c *EncryptDecryptCommand) Run(args []string) (ret int) {
 	raw, err = configutil.EncryptDecrypt(raw, c.Func == "decrypt", c.flagStrip, wrapper)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error %sing via kms: %w", c.Func, err).Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	if !c.flagOverwrite {
 		c.UI.Output(raw)
-		return 0
+		return base.CommandSuccess
 	}
 
 	file, err := os.Create(c.flagConfig)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error opening file for writing: %w", err).Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	defer func() {
 		if err := file.Close(); err != nil {
 			c.UI.Error(fmt.Errorf("Error closing file after writing: %w", err).Error())
-			ret = 1
+			ret = base.CommandCliError
 		}
 	}()
 
 	n, err := file.WriteString(raw)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error writing to file: %w", err).Error())
-		return 1
+		return base.CommandCliError
 	}
 	if n != len(raw) {
 		c.UI.Error(fmt.Sprintf("Wrong number of bytes written to file, expected %d, wrote %d", len(raw), n))
diff --git a/internal/cmd/commands/config/token.go b/internal/cmd/commands/config/token.go
index 875c1d9e9..fef3e4d7c 100644
--- a/internal/cmd/commands/config/token.go
+++ b/internal/cmd/commands/config/token.go
@@ -104,7 +104,7 @@ func (c *TokenCommand) Run(args []string) (ret int) {
 	f := c.Flags()
 	if err := f.Parse(args); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	var optCount int
@@ -120,7 +120,7 @@ func (c *TokenCommand) Run(args []string) (ret int) {
 
 	if optCount > 1 {
 		c.UI.Error("Only zero or one output option can be specified.")
-		return 1
+		return base.CommandUserError
 	}
 
 	// Read from client first as that will override keyring anyways
@@ -129,7 +129,7 @@ func (c *TokenCommand) Run(args []string) (ret int) {
 	client, err := c.Client()
 	if err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandCliError
 	}
 	if client.Token() != "" {
 		authToken = &authtokens.AuthToken{Token: client.Token()}
@@ -139,7 +139,7 @@ func (c *TokenCommand) Run(args []string) (ret int) {
 		keyringType, tokenName, err := c.DiscoverKeyringTokenInfo()
 		if err != nil {
 			c.UI.Error(err.Error())
-			return 1
+			return base.CommandCliError
 		}
 
 		authToken = c.ReadTokenFromKeyring(keyringType, tokenName)
@@ -147,34 +147,34 @@ func (c *TokenCommand) Run(args []string) (ret int) {
 
 	if authToken == nil {
 		c.UI.Error("No token could be discovered")
-		return 1
+		return base.CommandCliError
 	}
 
 	switch {
 	case c.flagUserId:
 		if authToken.UserId == "" {
-			return 1
+			return base.CommandUserError
 		}
 		c.UI.Output(authToken.UserId)
 
 	case c.flagAccountId:
 		if authToken.AccountId == "" {
-			return 1
+			return base.CommandUserError
 		}
 		c.UI.Output(authToken.AccountId)
 
 	case c.flagAuthMethodId:
 		if authToken.AuthMethodId == "" {
-			return 1
+			return base.CommandUserError
 		}
 		c.UI.Output(authToken.AuthMethodId)
 
 	default:
 		if authToken.Token == "" {
-			return 1
+			return base.CommandUserError
 		}
 		c.UI.Output(authToken.Token)
 	}
 
-	return 0
+	return base.CommandSuccess
 }
diff --git a/internal/cmd/commands/connect/connect.go b/internal/cmd/commands/connect/connect.go
index 3af6bbdbd..8b8758981 100644
--- a/internal/cmd/commands/connect/connect.go
+++ b/internal/cmd/commands/connect/connect.go
@@ -266,7 +266,7 @@ func (c *Command) Run(args []string) (retCode int) {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 3
+		return base.CommandUserError
 	}
 
 	switch {
@@ -274,22 +274,22 @@ func (c *Command) Run(args []string) (retCode int) {
 		switch {
 		case c.flagTargetId != "":
 			c.PrintCliError(errors.New(`-target-id and -authz-token cannot both be specified`))
-			return 3
+			return base.CommandUserError
 		case c.flagTargetName != "":
 			c.PrintCliError(errors.New(`-target-name and -authz-token cannot both be specified`))
-			return 3
+			return base.CommandUserError
 		}
 	default:
 		if c.flagTargetId == "" &&
 			(c.flagTargetName == "" ||
 				(c.FlagScopeId == "" && c.FlagScopeName == "")) {
 			c.PrintCliError(errors.New("Target ID was not passed in, but no combination of target name and scope ID/name was passed in either"))
-			return 3
+			return base.CommandUserError
 		}
 		if c.flagTargetId != "" &&
 			(c.flagTargetName != "" || c.FlagScopeId != "" || c.FlagScopeName != "") {
 			c.PrintCliError(errors.New("Cannot specify a target ID and also other lookup parameters"))
-			return 3
+			return base.CommandUserError
 		}
 	}
 
@@ -311,7 +311,7 @@ func (c *Command) Run(args []string) (retCode int) {
 	tofuToken, err := base62.Random(20)
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Could not derive random bytes for tofu token: %w", err))
-		return 2
+		return base.CommandCliError
 	}
 
 	c.connsLeftCh = make(chan int32)
@@ -322,7 +322,7 @@ func (c *Command) Run(args []string) (retCode int) {
 	listenAddr := net.ParseIP(c.flagListenAddr)
 	if listenAddr == nil {
 		c.PrintCliError(fmt.Errorf("Could not successfully parse listen address of %s", c.flagListenAddr))
-		return 3
+		return base.CommandUserError
 	}
 
 	authzString := c.flagAuthzToken
@@ -332,18 +332,18 @@ func (c *Command) Run(args []string) (retCode int) {
 			authBytes, err := ioutil.ReadAll(os.Stdin)
 			if err != nil {
 				c.PrintCliError(fmt.Errorf("No authorization string was provided and encountered the following error attempting to read it from stdin: %w", err))
-				return 3
+				return base.CommandUserError
 			}
 			if len(authBytes) == 0 {
 				c.PrintCliError(errors.New("No authorization data read from stdin"))
-				return 3
+				return base.CommandUserError
 			}
 			authzString = string(authBytes)
 		}
 
 		if authzString == "" {
 			c.PrintCliError(errors.New("Authorization data was empty"))
-			return 3
+			return base.CommandUserError
 		}
 
 		if authzString[0] == '{' {
@@ -359,7 +359,7 @@ func (c *Command) Run(args []string) (retCode int) {
 		client, err := c.Client()
 		if err != nil {
 			c.PrintCliError(fmt.Errorf("Error creating API client: %s", err))
-			return 2
+			return base.CommandCliError
 		}
 		targetClient := targets.NewClient(client)
 
@@ -381,10 +381,10 @@ func (c *Command) Run(args []string) (retCode int) {
 		if err != nil {
 			if apiErr := api.AsServerError(err); apiErr != nil {
 				c.PrintApiError(apiErr, "Error from controller when performing authorize-session action against given target")
-				return 1
+				return base.CommandApiError
 			}
 			c.PrintCliError(fmt.Errorf("Error trying to authorize a session against target: %w", err))
-			return 2
+			return base.CommandCliError
 		}
 		authzString = sar.GetItem().(*targets.SessionAuthorization).AuthorizationToken
 	}
@@ -392,22 +392,22 @@ func (c *Command) Run(args []string) (retCode int) {
 	marshaled, err := base58.FastBase58Decoding(authzString)
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Unable to base58-decode authorization data: %w", err))
-		return 3
+		return base.CommandUserError
 	}
 	if len(marshaled) == 0 {
 		c.PrintCliError(errors.New("Zero length authorization information after decoding"))
-		return 3
+		return base.CommandUserError
 	}
 
 	c.sessionAuthzData = new(targetspb.SessionAuthorizationData)
 	if err := proto.Unmarshal(marshaled, c.sessionAuthzData); err != nil {
 		c.PrintCliError(fmt.Errorf("Unable to proto-decode authorization data: %w", err))
-		return 3
+		return base.CommandUserError
 	}
 
 	if len(c.sessionAuthzData.GetWorkerInfo()) == 0 {
 		c.PrintCliError(errors.New("No workers found in authorization string"))
-		return 3
+		return base.CommandUserError
 	}
 
 	c.connectionsLeft.Store(c.sessionAuthzData.ConnectionLimit)
@@ -416,12 +416,12 @@ func (c *Command) Run(args []string) (retCode int) {
 	parsedCert, err := x509.ParseCertificate(c.sessionAuthzData.Certificate)
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Unable to decode mTLS certificate: %w", err))
-		return 3
+		return base.CommandUserError
 	}
 
 	if len(parsedCert.DNSNames) != 1 {
 		c.PrintCliError(fmt.Errorf("mTLS certificate has invalid parameters: %w", err))
-		return 3
+		return base.CommandUserError
 	}
 
 	c.expiration = parsedCert.NotAfter
@@ -461,7 +461,7 @@ func (c *Command) Run(args []string) (retCode int) {
 	})
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error starting listening port: %w", err))
-		return 2
+		return base.CommandCliError
 	}
 
 	listenerCloseFunc := func() {
@@ -497,7 +497,7 @@ func (c *Command) Run(args []string) (retCode int) {
 			out, err := json.Marshal(&sessInfo)
 			if err != nil {
 				c.PrintCliError(fmt.Errorf("error marshaling session information: %w", err))
-				return 2
+				return base.CommandCliError
 			}
 			c.UI.Output(string(out))
 		}
@@ -623,7 +623,7 @@ func (c *Command) Run(args []string) (retCode int) {
 			out, err := json.Marshal(&termInfo)
 			if err != nil {
 				c.PrintCliError(fmt.Errorf("error marshaling termination information: %w", err))
-				return 2
+				return base.CommandCliError
 			}
 			c.UI.Output(string(out))
 		}
diff --git a/internal/cmd/commands/database/funcs.go b/internal/cmd/commands/database/funcs.go
index c3661cb92..0ad4fba97 100644
--- a/internal/cmd/commands/database/funcs.go
+++ b/internal/cmd/commands/database/funcs.go
@@ -22,11 +22,11 @@ func migrateDatabase(ctx context.Context, ui cli.Ui, dialect, u string, requireF
 	dBase, err := sql.Open(dialect, u)
 	if err != nil {
 		ui.Error(fmt.Errorf("Error establishing db connection: %w", err).Error())
-		return noop, 1
+		return noop, 2
 	}
 	if err := dBase.PingContext(ctx); err != nil {
 		ui.Error(fmt.Sprintf("Unable to connect to the database at %q", u))
-		return noop, 1
+		return noop, 2
 	}
 	man, err := schema.NewManager(ctx, dialect, dBase)
 	if err != nil {
@@ -35,12 +35,12 @@ func migrateDatabase(ctx context.Context, ui cli.Ui, dialect, u string, requireF
 		} else {
 			ui.Error(fmt.Errorf("Error setting up schema manager: %w", err).Error())
 		}
-		return noop, 1
+		return noop, 2
 	}
 	// This is an advisory lock on the DB which is released when the DB session ends.
 	if err := man.ExclusiveLock(ctx); err != nil {
 		ui.Error("Unable to capture a lock on the database.")
-		return noop, 1
+		return noop, 2
 	}
 	unlock := func() {
 		// We don't report anything since this should resolve itself anyways.
@@ -50,19 +50,19 @@ func migrateDatabase(ctx context.Context, ui cli.Ui, dialect, u string, requireF
 	st, err := man.CurrentState(ctx)
 	if err != nil {
 		ui.Error(fmt.Errorf("Error getting database state: %w", err).Error())
-		return unlock, 1
+		return unlock, 2
 	}
 	if requireFresh && st.InitializationStarted {
 		ui.Error(base.WrapAtLength("Database has already been initialized.  Please use 'boundary database migrate'."))
-		return unlock, 1
+		return unlock, 2
 	}
 	if st.Dirty {
 		ui.Error(base.WrapAtLength("Database is in a bad state.  Please revert back to the last known good state."))
-		return unlock, 1
+		return unlock, 2
 	}
 	if err := man.RollForward(ctx); err != nil {
 		ui.Error(fmt.Errorf("Error running database migrations: %w", err).Error())
-		return unlock, 1
+		return unlock, 2
 	}
 	if base.Format(ui) == "table" {
 		ui.Info("Migrations successfully run.")
diff --git a/internal/cmd/commands/database/funcs_test.go b/internal/cmd/commands/database/funcs_test.go
index 0cc4d524a..5911666a7 100644
--- a/internal/cmd/commands/database/funcs_test.go
+++ b/internal/cmd/commands/database/funcs_test.go
@@ -60,7 +60,7 @@ func TestMigrateDatabase(t *testing.T) {
 		{
 			name:          "bad_url",
 			urlProvider:   func() string { return "badurl" },
-			expectedCode:  1,
+			expectedCode:  2,
 			expectedError: "Unable to connect to the database at \"badurl\"\n",
 		},
 		{
@@ -82,7 +82,7 @@ func TestMigrateDatabase(t *testing.T) {
 
 				return u
 			},
-			expectedCode:  1,
+			expectedCode:  2,
 			expectedError: "Unable to capture a lock on the database.\n",
 		},
 		{
@@ -116,14 +116,14 @@ func TestMigrateDatabase(t *testing.T) {
 				require.NoError(t, err)
 				return u
 			},
-			expectedCode:  1,
+			expectedCode:  2,
 			expectedError: "Database has already been initialized.  Please use 'boundary database\nmigrate'.\n",
 		},
 		{
 			name:          "bad_url_require_fresh",
 			requireFresh:  true,
 			urlProvider:   func() string { return "badurl" },
-			expectedCode:  1,
+			expectedCode:  2,
 			expectedError: "Unable to connect to the database at \"badurl\"\n",
 		},
 		{
@@ -146,7 +146,7 @@ func TestMigrateDatabase(t *testing.T) {
 
 				return u
 			},
-			expectedCode:  1,
+			expectedCode:  2,
 			expectedError: "Unable to capture a lock on the database.\n",
 		},
 	}
diff --git a/internal/cmd/commands/database/init.go b/internal/cmd/commands/database/init.go
index c278de830..d000d574e 100644
--- a/internal/cmd/commands/database/init.go
+++ b/internal/cmd/commands/database/init.go
@@ -181,17 +181,17 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 
 	if err := c.srv.SetupLogging(c.flagLogLevel, c.flagLogFormat, c.Config.LogLevel, c.Config.LogFormat); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	if err := c.srv.SetupKMSes(c.UI, c.Config); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	if c.srv.RootKms == nil {
 		c.UI.Error("Root KMS not found after parsing KMS blocks")
-		return 1
+		return base.CommandCliError
 	}
 
 	// If mlockall(2) isn't supported, show a warning. We disable this in dev
@@ -208,12 +208,12 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 
 	if c.Config.Controller == nil {
 		c.UI.Error(`"controller" config block not found`)
-		return 1
+		return base.CommandUserError
 	}
 
 	if c.Config.Controller.Database == nil {
 		c.UI.Error(`"controller.database" config block not found`)
-		return 1
+		return base.CommandUserError
 	}
 
 	var migrationUrlToParse string
@@ -230,13 +230,13 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 
 	if migrationUrlToParse == "" {
 		c.UI.Error(base.WrapAtLength(`neither "url" nor "migration_url" correctly set in "database" config block nor was the "migration-url" flag used`))
-		return 1
+		return base.CommandUserError
 	}
 
 	migrationUrl, err := config.ParseAddress(migrationUrlToParse)
 	if err != nil && err != config.ErrNotAUrl {
 		c.UI.Error(fmt.Errorf("Error parsing migration url: %w", err).Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	clean, errCode := migrateDatabase(c.Context, c.UI, dialect, migrationUrl, true)
@@ -248,25 +248,25 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 	urlToParse := c.Config.Controller.Database.Url
 	if urlToParse == "" {
 		c.UI.Error(`"url" not specified in "database" config block`)
-		return 1
+		return base.CommandUserError
 	}
 	c.srv.DatabaseUrl, err = config.ParseAddress(urlToParse)
 	if err != nil && err != config.ErrNotAUrl {
 		c.UI.Error(fmt.Errorf("Error parsing database url: %w", err).Error())
-		return 1
+		return base.CommandUserError
 	}
 	// Everything after is done with normal database URL and is affecting actual data
 	if err := c.srv.ConnectToDatabase(dialect); err != nil {
 		c.UI.Error(fmt.Errorf("Error connecting to database after migrations: %w", err).Error())
-		return 1
+		return base.CommandCliError
 	}
 	if err := c.verifyOplogIsEmpty(); err != nil {
 		c.UI.Error(fmt.Sprintf("The database appears to have already been initialized: %v", err))
-		return 1
+		return base.CommandCliError
 	}
 	if err := c.srv.CreateGlobalKmsKeys(c.Context); err != nil {
 		c.UI.Error(fmt.Errorf("Error creating global-scope KMS keys: %w", err).Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	if base.Format(c.UI) == "table" {
@@ -280,7 +280,7 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 			b, err := base.JsonFormatter{}.Format(jsonMap)
 			if err != nil {
 				c.UI.Error(fmt.Errorf("Error formatting as JSON: %w", err).Error())
-				retCode = 1
+				retCode = 2
 				return
 			}
 			c.UI.Output(string(b))
@@ -288,13 +288,13 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 	}
 
 	if c.flagSkipInitialLoginRoleCreation {
-		return 0
+		return base.CommandSuccess
 	}
 
 	role, err := c.srv.CreateInitialLoginRole(c.Context)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error creating initial global-scoped login role: %w", err).Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	roleInfo := &RoleInfo{
@@ -309,7 +309,7 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 	}
 
 	if c.flagSkipAuthMethodCreation {
-		return 0
+		return base.CommandSuccess
 	}
 
 	// Use an easy name, at least
@@ -317,7 +317,7 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 	am, user, err := c.srv.CreateInitialAuthMethod(c.Context)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error creating initial auth method and user: %w", err).Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	authMethodInfo := &AuthInfo{
@@ -337,13 +337,13 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 	}
 
 	if c.flagSkipScopesCreation {
-		return 0
+		return base.CommandSuccess
 	}
 
 	orgScope, projScope, err := c.srv.CreateInitialScopes(c.Context)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error creating initial scopes: %w", err).Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	orgScopeInfo := &ScopeInfo{
@@ -371,13 +371,13 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 	}
 
 	if c.flagSkipHostResourcesCreation {
-		return 0
+		return base.CommandSuccess
 	}
 
 	hc, hs, h, err := c.srv.CreateInitialHostResources(c.Context)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error creating initial host resources: %w", err).Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	hostInfo := &HostInfo{
@@ -398,14 +398,14 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 	}
 
 	if c.flagSkipTargetCreation {
-		return 0
+		return base.CommandSuccess
 	}
 
 	c.srv.DevTargetSessionConnectionLimit = -1
 	t, err := c.srv.CreateInitialTarget(c.Context)
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error creating initial target: %w", err).Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	targetInfo := &TargetInfo{
@@ -424,7 +424,7 @@ func (c *InitCommand) Run(args []string) (retCode int) {
 		jsonMap["target"] = targetInfo
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 func (c *InitCommand) ParseFlagsAndConfig(args []string) int {
@@ -434,14 +434,14 @@ func (c *InitCommand) ParseFlagsAndConfig(args []string) int {
 
 	if err = f.Parse(args); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	// Validation
 	switch {
 	case len(c.flagConfig) == 0:
 		c.UI.Error("Must specify a config file using -config")
-		return 1
+		return base.CommandUserError
 	}
 
 	wrapperPath := c.flagConfig
@@ -451,23 +451,23 @@ func (c *InitCommand) ParseFlagsAndConfig(args []string) int {
 	wrapper, err := wrapper.GetWrapperFromPath(wrapperPath, "config")
 	if err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 	if wrapper != nil {
 		c.configWrapper = wrapper
 		if err := wrapper.Init(c.Context); err != nil {
 			c.UI.Error(fmt.Errorf("Could not initialize kms: %w", err).Error())
-			return 1
+			return base.CommandUserError
 		}
 	}
 
 	c.Config, err = config.LoadFile(c.flagConfig, wrapper)
 	if err != nil {
 		c.UI.Error("Error parsing config: " + err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 func (c *InitCommand) verifyOplogIsEmpty() error {
diff --git a/internal/cmd/commands/database/migrate.go b/internal/cmd/commands/database/migrate.go
index 914b60385..aae29ae3e 100644
--- a/internal/cmd/commands/database/migrate.go
+++ b/internal/cmd/commands/database/migrate.go
@@ -132,7 +132,7 @@ func (c *MigrateCommand) Run(args []string) (retCode int) {
 
 	if err := c.srv.SetupLogging(c.flagLogLevel, c.flagLogFormat, c.Config.LogLevel, c.Config.LogFormat); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandCliError
 	}
 
 	// If mlockall(2) isn't supported, show a warning. We disable this in dev
@@ -149,12 +149,12 @@ func (c *MigrateCommand) Run(args []string) (retCode int) {
 
 	if c.Config.Controller == nil {
 		c.UI.Error(`"controller" config block not found`)
-		return 1
+		return base.CommandUserError
 	}
 
 	if c.Config.Controller.Database == nil {
 		c.UI.Error(`"controller.database" config block not found`)
-		return 1
+		return base.CommandUserError
 	}
 
 	var migrationUrlToParse string
@@ -171,13 +171,13 @@ func (c *MigrateCommand) Run(args []string) (retCode int) {
 
 	if migrationUrlToParse == "" {
 		c.UI.Error(base.WrapAtLength(`neither "url" nor "migration_url" correctly set in "database" config block nor was the "migration-url" flag used`))
-		return 1
+		return base.CommandUserError
 	}
 
 	migrationUrl, err := config.ParseAddress(migrationUrlToParse)
 	if err != nil && err != config.ErrNotAUrl {
 		c.UI.Error(fmt.Errorf("Error parsing migration url: %w", err).Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	clean, errCode := migrateDatabase(c.Context, c.UI, dialect, migrationUrl, false)
@@ -186,7 +186,7 @@ func (c *MigrateCommand) Run(args []string) (retCode int) {
 		return errCode
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 func (c *MigrateCommand) ParseFlagsAndConfig(args []string) int {
@@ -196,14 +196,14 @@ func (c *MigrateCommand) ParseFlagsAndConfig(args []string) int {
 
 	if err = f.Parse(args); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	// Validation
 	switch {
 	case len(c.flagConfig) == 0:
 		c.UI.Error("Must specify a config file using -config")
-		return 1
+		return base.CommandUserError
 	}
 
 	wrapperPath := c.flagConfig
@@ -213,21 +213,21 @@ func (c *MigrateCommand) ParseFlagsAndConfig(args []string) int {
 	wrapper, err := wrapper.GetWrapperFromPath(wrapperPath, "config")
 	if err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 	if wrapper != nil {
 		c.configWrapper = wrapper
 		if err := wrapper.Init(c.Context); err != nil {
 			c.UI.Error(fmt.Errorf("Could not initialize kms: %w", err).Error())
-			return 1
+			return base.CommandUserError
 		}
 	}
 
 	c.Config, err = config.LoadFile(c.flagConfig, wrapper)
 	if err != nil {
 		c.UI.Error("Error parsing config: " + err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
-	return 0
+	return base.CommandSuccess
 }
diff --git a/internal/cmd/commands/dev/dev.go b/internal/cmd/commands/dev/dev.go
index fb71592f7..f16b974a1 100644
--- a/internal/cmd/commands/dev/dev.go
+++ b/internal/cmd/commands/dev/dev.go
@@ -259,7 +259,7 @@ func (c *Command) Run(args []string) int {
 
 	if err = f.Parse(args); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	// childShutdownCh := make(chan struct{})
@@ -267,16 +267,16 @@ func (c *Command) Run(args []string) int {
 	c.Config, err = config.DevCombined()
 	if err != nil {
 		c.UI.Error(fmt.Errorf("Error creating controller dev config: %w", err).Error())
-		return 1
+		return base.CommandUserError
 	}
 	if c.flagIdSuffix != "" {
 		if len(c.flagIdSuffix) != 10 {
 			c.UI.Error("Invalid ID suffix, must be exactly 10 characters")
-			return 1
+			return base.CommandUserError
 		}
 		if !handlers.ValidId("abc", "abc_"+c.flagIdSuffix) {
 			c.UI.Error("Invalid ID suffix, must be in the set A-Za-z0-9")
-			return 1
+			return base.CommandUserError
 		}
 		c.DevAuthMethodId = fmt.Sprintf("%s_%s", password.AuthMethodPrefix, c.flagIdSuffix)
 		c.DevUserId = fmt.Sprintf("%s_%s", iam.UserPrefix, c.flagIdSuffix)
@@ -305,17 +305,17 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if !strings.Contains(err.Error(), "missing port") {
 			c.UI.Error(fmt.Errorf("Invalid host address specified: %w", err).Error())
-			return 1
+			return base.CommandUserError
 		}
 		host = c.flagHostAddress
 	}
 	if port != "" {
 		c.UI.Error(`Port must not be specified as part of the dev host address`)
-		return 1
+		return base.CommandUserError
 	}
 	if c.flagTargetSessionMaxSeconds < 0 {
 		c.UI.Error(`Specified target session max sessions cannot be negative`)
-		return 1
+		return base.CommandUserError
 	}
 	c.DevTargetSessionMaxSeconds = c.flagTargetSessionMaxSeconds
 	c.DevTargetSessionConnectionLimit = c.flagTargetSessionConnectionLimit
@@ -326,7 +326,7 @@ func (c *Command) Run(args []string) int {
 	for _, l := range c.Config.Listeners {
 		if len(l.Purpose) != 1 {
 			c.UI.Error("Only one purpose supported for each listener")
-			return 1
+			return base.CommandUserError
 		}
 		switch l.Purpose[0] {
 		case "api":
@@ -359,28 +359,28 @@ func (c *Command) Run(args []string) int {
 
 	if err := c.SetupControllerPublicClusterAddress(c.Config, c.flagControllerPublicClusterAddr); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 	c.InfoKeys = append(c.InfoKeys, "controller public cluster addr")
 	c.Info["controller public cluster addr"] = c.Config.Controller.PublicClusterAddr
 
 	if err := c.SetupWorkerPublicAddress(c.Config, c.flagWorkerPublicAddr); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 	c.InfoKeys = append(c.InfoKeys, "worker public proxy addr")
 	c.Info["worker public proxy addr"] = c.Config.Worker.PublicAddr
 
 	if err := c.SetupLogging(c.flagLogLevel, c.flagLogFormat, "", ""); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	base.StartMemProfiler(c.Logger)
 
 	if err := c.SetupMetrics(c.UI, c.Config.Telemetry); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	if c.flagRecoveryKey != "" {
@@ -388,15 +388,15 @@ func (c *Command) Run(args []string) int {
 	}
 	if err := c.SetupKMSes(c.UI, c.Config); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 	if c.RootKms == nil {
 		c.UI.Error("Controller KMS not found after parsing KMS blocks")
-		return 1
+		return base.CommandUserError
 	}
 	if c.WorkerAuthKms == nil {
 		c.UI.Error("Worker Auth KMS not found after parsing KMS blocks")
-		return 1
+		return base.CommandUserError
 	}
 	c.InfoKeys = append(c.InfoKeys, "[Controller] AEAD Key Bytes")
 	c.Info["[Controller] AEAD Key Bytes"] = c.Config.DevControllerKey
@@ -408,13 +408,13 @@ func (c *Command) Run(args []string) int {
 	// Initialize the listeners
 	if err := c.SetupListeners(c.UI, c.Config.SharedConfig, []string{"api", "cluster", "proxy"}); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	// Write out the PID to the file now that server has successfully started
 	if err := c.StorePidFile(c.Config.PidFile); err != nil {
 		c.UI.Error(fmt.Errorf("Error storing PID: %w", err).Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	defer func() {
@@ -432,10 +432,10 @@ func (c *Command) Run(args []string) int {
 		if err := c.CreateDevDatabase(c.Context, "postgres", opts...); err != nil {
 			if err == docker.ErrDockerUnsupported {
 				c.UI.Error("Automatically starting a Docker container running Postgres is not currently supported on this platform. Please use -database-url to pass in a URL (or an env var or file reference to a URL) for connecting to an existing empty database.")
-				return 1
+				return base.CommandCliError
 			}
 			c.UI.Error(fmt.Errorf("Error creating dev database container: %w", err).Error())
-			return 1
+			return base.CommandCliError
 		}
 		if !c.flagDisableDatabaseDestruction {
 			c.ShutdownFuncs = append(c.ShutdownFuncs, c.DestroyDevDatabase)
@@ -444,11 +444,11 @@ func (c *Command) Run(args []string) int {
 		c.DatabaseUrl, err = config.ParseAddress(c.flagDatabaseUrl)
 		if err != nil && err != config.ErrNotAUrl {
 			c.UI.Error(fmt.Errorf("Error parsing database url: %w", err).Error())
-			return 1
+			return base.CommandUserError
 		}
 		if err := c.CreateDevDatabase(c.Context, "postgres"); err != nil {
 			c.UI.Error(fmt.Errorf("Error connecting to database: %w", err).Error())
-			return 1
+			return base.CommandCliError
 		}
 	}
 
@@ -465,7 +465,7 @@ func (c *Command) Run(args []string) int {
 		c.controller, err = controller.New(conf)
 		if err != nil {
 			c.UI.Error(fmt.Errorf("Error initializing controller: %w", err).Error())
-			return 1
+			return base.CommandCliError
 		}
 
 		if err := c.controller.Start(); err != nil {
@@ -475,7 +475,7 @@ func (c *Command) Run(args []string) int {
 				retErr = fmt.Errorf("Error shutting down controller: %w", err)
 			}
 			c.UI.Error(retErr.Error())
-			return 1
+			return base.CommandCliError
 		}
 	}
 	{
@@ -488,7 +488,7 @@ func (c *Command) Run(args []string) int {
 		c.worker, err = worker.New(conf)
 		if err != nil {
 			c.UI.Error(fmt.Errorf("Error initializing controller: %w", err).Error())
-			return 1
+			return base.CommandCliError
 		}
 
 		if err := c.worker.Start(); err != nil {
@@ -501,7 +501,7 @@ func (c *Command) Run(args []string) int {
 			if err := c.controller.Shutdown(false); err != nil {
 				c.UI.Error(fmt.Errorf("Error with controller shutdown: %w", err).Error())
 			}
-			return 1
+			return base.CommandCliError
 		}
 	}
 
@@ -530,5 +530,5 @@ func (c *Command) Run(args []string) int {
 		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
diff --git a/internal/cmd/commands/groupscmd/funcs.go b/internal/cmd/commands/groupscmd/funcs.go
index f25a753f3..b69ff240b 100644
--- a/internal/cmd/commands/groupscmd/funcs.go
+++ b/internal/cmd/commands/groupscmd/funcs.go
@@ -105,19 +105,19 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 	}
 }
 
-func extraFlagsHandlingFuncImpl(c *Command, opts *[]groups.Option) int {
+func extraFlagsHandlingFuncImpl(c *Command, opts *[]groups.Option) bool {
 	switch c.Func {
 	case "add-members", "remove-members":
 		if len(c.flagMembers) == 0 {
 			c.UI.Error("No members supplied via -member")
-			return 1
+			return false
 		}
 
 	case "set-members":
 		switch len(c.flagMembers) {
 		case 0:
 			c.UI.Error("No members supplied via -member")
-			return 1
+			return false
 		case 1:
 			if c.flagMembers[0] == "null" {
 				c.flagMembers = nil
@@ -125,7 +125,7 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]groups.Option) int {
 		}
 	}
 
-	return 0
+	return true
 }
 
 func executeExtraActionsImpl(c *Command, origResult api.GenericResult, origError error, groupClient *groups.Client, version uint32, opts []groups.Option) (api.GenericResult, error) {
diff --git a/internal/cmd/commands/groupscmd/groups.gen.go b/internal/cmd/commands/groupscmd/groups.gen.go
index 5af11740e..ddf26b74c 100644
--- a/internal/cmd/commands/groupscmd/groups.gen.go
+++ b/internal/cmd/commands/groupscmd/groups.gen.go
@@ -139,12 +139,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []groups.Option
@@ -155,13 +155,13 @@ func (c *Command) Run(args []string) int {
 		case "create":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 
 		case "list":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 
 		}
@@ -170,7 +170,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	groupsClient := groups.NewClient(client)
 
@@ -237,8 +237,8 @@ func (c *Command) Run(args []string) int {
 
 	}
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -275,19 +275,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -308,7 +308,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*groups.Group)
@@ -324,14 +324,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -341,10 +343,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -353,7 +357,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]groups.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]groups.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *groups.Client, _ uint32, _ []groups.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/hostcatalogscmd/hostcatalogs.gen.go b/internal/cmd/commands/hostcatalogscmd/hostcatalogs.gen.go
index 12d258a35..4cf61aba7 100644
--- a/internal/cmd/commands/hostcatalogscmd/hostcatalogs.gen.go
+++ b/internal/cmd/commands/hostcatalogscmd/hostcatalogs.gen.go
@@ -131,12 +131,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []hostcatalogs.Option
@@ -146,7 +146,7 @@ func (c *Command) Run(args []string) int {
 		case "list":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -154,7 +154,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	hostcatalogsClient := hostcatalogs.NewClient(client)
 
@@ -169,8 +169,8 @@ func (c *Command) Run(args []string) int {
 
 	var version uint32
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -201,19 +201,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -234,7 +234,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*hostcatalogs.HostCatalog)
@@ -250,14 +250,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -267,10 +269,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -279,7 +283,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]hostcatalogs.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]hostcatalogs.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *hostcatalogs.Client, _ uint32, _ []hostcatalogs.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/hostcatalogscmd/static_hostcatalogs.gen.go b/internal/cmd/commands/hostcatalogscmd/static_hostcatalogs.gen.go
index a11324e07..8e77b2b01 100644
--- a/internal/cmd/commands/hostcatalogscmd/static_hostcatalogs.gen.go
+++ b/internal/cmd/commands/hostcatalogscmd/static_hostcatalogs.gen.go
@@ -114,12 +114,12 @@ func (c *StaticCommand) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsStaticMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []hostcatalogs.Option
@@ -129,7 +129,7 @@ func (c *StaticCommand) Run(args []string) int {
 		case "create":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -137,7 +137,7 @@ func (c *StaticCommand) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	hostcatalogsClient := hostcatalogs.NewClient(client)
 
@@ -178,8 +178,8 @@ func (c *StaticCommand) Run(args []string) int {
 		}
 	}
 
-	if ret := extraStaticFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraStaticFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	var result api.GenericResult
@@ -199,19 +199,19 @@ func (c *StaticCommand) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomStaticActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -223,17 +223,19 @@ func (c *StaticCommand) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
 	extraStaticActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraStaticSynopsisFunc        = func(*StaticCommand) string { return "" }
 	extraStaticFlagsFunc           = func(*StaticCommand, *base.FlagSets, *base.FlagSet) {}
-	extraStaticFlagsHandlingFunc   = func(*StaticCommand, *[]hostcatalogs.Option) int { return 0 }
+	extraStaticFlagsHandlingFunc   = func(*StaticCommand, *[]hostcatalogs.Option) bool { return true }
 	executeExtraStaticActions      = func(_ *StaticCommand, inResult api.GenericResult, inErr error, _ *hostcatalogs.Client, _ uint32, _ []hostcatalogs.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/hostscmd/hosts.gen.go b/internal/cmd/commands/hostscmd/hosts.gen.go
index bd39d028c..f05ed727f 100644
--- a/internal/cmd/commands/hostscmd/hosts.gen.go
+++ b/internal/cmd/commands/hostscmd/hosts.gen.go
@@ -131,12 +131,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []hosts.Option
@@ -146,7 +146,7 @@ func (c *Command) Run(args []string) int {
 		case "list":
 			if c.FlagHostCatalogId == "" {
 				c.PrintCliError(errors.New("HostCatalog ID must be passed in via -host-catalog-id or BOUNDARY_HOST_CATALOG_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -154,7 +154,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	hostsClient := hosts.NewClient(client)
 
@@ -180,8 +180,8 @@ func (c *Command) Run(args []string) int {
 
 	var version uint32
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -212,19 +212,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -245,7 +245,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*hosts.Host)
@@ -261,14 +261,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -278,10 +280,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -290,7 +294,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]hosts.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]hosts.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *hosts.Client, _ uint32, _ []hosts.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/hostscmd/static_funcs.go b/internal/cmd/commands/hostscmd/static_funcs.go
index 028a9d711..ffa421076 100644
--- a/internal/cmd/commands/hostscmd/static_funcs.go
+++ b/internal/cmd/commands/hostscmd/static_funcs.go
@@ -68,10 +68,10 @@ func extraStaticFlagsFuncImpl(c *StaticCommand, set *base.FlagSets, _ *base.Flag
 	}
 }
 
-func extraStaticFlagsHandlingFuncImpl(c *StaticCommand, opts *[]hosts.Option) int {
+func extraStaticFlagsHandlingFuncImpl(c *StaticCommand, opts *[]hosts.Option) bool {
 	if c.Func == "create" && c.flagAddress == "" {
 		c.UI.Error("Address must be provided via -address")
-		return 1
+		return false
 	}
 
 	switch c.flagAddress {
@@ -82,5 +82,5 @@ func extraStaticFlagsHandlingFuncImpl(c *StaticCommand, opts *[]hosts.Option) in
 		*opts = append(*opts, hosts.WithStaticHostAddress(c.flagAddress))
 	}
 
-	return 0
+	return true
 }
diff --git a/internal/cmd/commands/hostscmd/static_hosts.gen.go b/internal/cmd/commands/hostscmd/static_hosts.gen.go
index 48b808825..602ef3442 100644
--- a/internal/cmd/commands/hostscmd/static_hosts.gen.go
+++ b/internal/cmd/commands/hostscmd/static_hosts.gen.go
@@ -116,12 +116,12 @@ func (c *StaticCommand) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsStaticMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []hosts.Option
@@ -131,7 +131,7 @@ func (c *StaticCommand) Run(args []string) int {
 		case "create":
 			if c.FlagHostCatalogId == "" {
 				c.PrintCliError(errors.New("HostCatalog ID must be passed in via -host-catalog-id or BOUNDARY_HOST_CATALOG_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -139,7 +139,7 @@ func (c *StaticCommand) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	hostsClient := hosts.NewClient(client)
 
@@ -175,8 +175,8 @@ func (c *StaticCommand) Run(args []string) int {
 		}
 	}
 
-	if ret := extraStaticFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraStaticFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	var result api.GenericResult
@@ -196,19 +196,19 @@ func (c *StaticCommand) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomStaticActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -220,17 +220,19 @@ func (c *StaticCommand) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
 	extraStaticActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraStaticSynopsisFunc        = func(*StaticCommand) string { return "" }
 	extraStaticFlagsFunc           = func(*StaticCommand, *base.FlagSets, *base.FlagSet) {}
-	extraStaticFlagsHandlingFunc   = func(*StaticCommand, *[]hosts.Option) int { return 0 }
+	extraStaticFlagsHandlingFunc   = func(*StaticCommand, *[]hosts.Option) bool { return true }
 	executeExtraStaticActions      = func(_ *StaticCommand, inResult api.GenericResult, inErr error, _ *hosts.Client, _ uint32, _ []hosts.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/hostsetscmd/funcs.go b/internal/cmd/commands/hostsetscmd/funcs.go
index 39538659b..773b8351d 100644
--- a/internal/cmd/commands/hostsetscmd/funcs.go
+++ b/internal/cmd/commands/hostsetscmd/funcs.go
@@ -137,19 +137,19 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 	}
 }
 
-func extraFlagsHandlingFuncImpl(c *Command, opts *[]hostsets.Option) int {
+func extraFlagsHandlingFuncImpl(c *Command, opts *[]hostsets.Option) bool {
 	switch c.Func {
 	case "add-hosts", "remove-hosts":
 		if len(c.flagHosts) == 0 {
 			c.UI.Error("No hosts supplied via -host")
-			return 1
+			return false
 		}
 
 	case "set-hosts":
 		switch len(c.flagHosts) {
 		case 0:
 			c.UI.Error("No hosts supplied via -host")
-			return 1
+			return false
 		case 1:
 			if c.flagHosts[0] == "null" {
 				c.flagHosts = nil
@@ -157,7 +157,7 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]hostsets.Option) int {
 		}
 	}
 
-	return 0
+	return true
 }
 
 func executeExtraActionsImpl(c *Command, origResult api.GenericResult, origError error, hostsetClient *hostsets.Client, version uint32, opts []hostsets.Option) (api.GenericResult, error) {
diff --git a/internal/cmd/commands/hostsetscmd/hostsets.gen.go b/internal/cmd/commands/hostsetscmd/hostsets.gen.go
index 031a5dcd3..47e80bbc1 100644
--- a/internal/cmd/commands/hostsetscmd/hostsets.gen.go
+++ b/internal/cmd/commands/hostsetscmd/hostsets.gen.go
@@ -133,12 +133,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []hostsets.Option
@@ -148,7 +148,7 @@ func (c *Command) Run(args []string) int {
 		case "list":
 			if c.FlagHostCatalogId == "" {
 				c.PrintCliError(errors.New("HostCatalog ID must be passed in via -host-catalog-id or BOUNDARY_HOST_CATALOG_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -156,7 +156,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	hostsetsClient := hostsets.NewClient(client)
 
@@ -210,8 +210,8 @@ func (c *Command) Run(args []string) int {
 
 	}
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -242,19 +242,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -275,7 +275,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*hostsets.HostSet)
@@ -291,14 +291,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -308,10 +310,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -320,7 +324,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]hostsets.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]hostsets.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *hostsets.Client, _ uint32, _ []hostsets.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/hostsetscmd/static_hostsets.gen.go b/internal/cmd/commands/hostsetscmd/static_hostsets.gen.go
index 88e594dd6..99d77cdc4 100644
--- a/internal/cmd/commands/hostsetscmd/static_hostsets.gen.go
+++ b/internal/cmd/commands/hostsetscmd/static_hostsets.gen.go
@@ -114,12 +114,12 @@ func (c *StaticCommand) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsStaticMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []hostsets.Option
@@ -129,7 +129,7 @@ func (c *StaticCommand) Run(args []string) int {
 		case "create":
 			if c.FlagHostCatalogId == "" {
 				c.PrintCliError(errors.New("HostCatalog ID must be passed in via -host-catalog-id or BOUNDARY_HOST_CATALOG_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -137,7 +137,7 @@ func (c *StaticCommand) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	hostsetsClient := hostsets.NewClient(client)
 
@@ -173,8 +173,8 @@ func (c *StaticCommand) Run(args []string) int {
 		}
 	}
 
-	if ret := extraStaticFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraStaticFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	var result api.GenericResult
@@ -194,19 +194,19 @@ func (c *StaticCommand) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomStaticActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -218,17 +218,19 @@ func (c *StaticCommand) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
 	extraStaticActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraStaticSynopsisFunc        = func(*StaticCommand) string { return "" }
 	extraStaticFlagsFunc           = func(*StaticCommand, *base.FlagSets, *base.FlagSet) {}
-	extraStaticFlagsHandlingFunc   = func(*StaticCommand, *[]hostsets.Option) int { return 0 }
+	extraStaticFlagsHandlingFunc   = func(*StaticCommand, *[]hostsets.Option) bool { return true }
 	executeExtraStaticActions      = func(_ *StaticCommand, inResult api.GenericResult, inErr error, _ *hostsets.Client, _ uint32, _ []hostsets.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/rolescmd/funcs.go b/internal/cmd/commands/rolescmd/funcs.go
index 1589964fe..6d5f9c136 100644
--- a/internal/cmd/commands/rolescmd/funcs.go
+++ b/internal/cmd/commands/rolescmd/funcs.go
@@ -167,7 +167,7 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 	}
 }
 
-func extraFlagsHandlingFuncImpl(c *Command, opts *[]roles.Option) int {
+func extraFlagsHandlingFuncImpl(c *Command, opts *[]roles.Option) bool {
 	switch c.flagGrantScopeId {
 	case "":
 	case "null":
@@ -180,20 +180,20 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]roles.Option) int {
 	case "add-principals", "remove-principals":
 		if len(c.flagPrincipals) == 0 {
 			c.UI.Error("No principals supplied via -principal")
-			return 1
+			return false
 		}
 
 	case "add-grants", "remove-grants":
 		if len(c.flagGrants) == 0 {
 			c.UI.Error("No grants supplied via -grant")
-			return 1
+			return false
 		}
 
 	case "set-principals":
 		switch len(c.flagPrincipals) {
 		case 0:
 			c.UI.Error("No principals supplied via -principal")
-			return 1
+			return false
 		case 1:
 			if c.flagPrincipals[0] == "null" {
 				c.flagPrincipals = nil
@@ -204,7 +204,7 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]roles.Option) int {
 		switch len(c.flagGrants) {
 		case 0:
 			c.UI.Error("No grants supplied via -grant")
-			return 1
+			return false
 		case 1:
 			if c.flagGrants[0] == "null" {
 				c.flagGrants = nil
@@ -217,12 +217,12 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]roles.Option) int {
 			_, err := perms.Parse("global", grant)
 			if err != nil {
 				c.UI.Error(fmt.Errorf("Grant %q could not be parsed successfully: %w", grant, err).Error())
-				return 1
+				return false
 			}
 		}
 	}
 
-	return 0
+	return true
 }
 
 func executeExtraActionsImpl(c *Command, origResult api.GenericResult, origError error, roleClient *roles.Client, version uint32, opts []roles.Option) (api.GenericResult, error) {
diff --git a/internal/cmd/commands/rolescmd/roles.gen.go b/internal/cmd/commands/rolescmd/roles.gen.go
index f18b364ce..d0f4bec90 100644
--- a/internal/cmd/commands/rolescmd/roles.gen.go
+++ b/internal/cmd/commands/rolescmd/roles.gen.go
@@ -139,12 +139,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []roles.Option
@@ -155,13 +155,13 @@ func (c *Command) Run(args []string) int {
 		case "create":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 
 		case "list":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 
 		}
@@ -170,7 +170,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	rolesClient := roles.NewClient(client)
 
@@ -261,8 +261,8 @@ func (c *Command) Run(args []string) int {
 
 	}
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -299,19 +299,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -332,7 +332,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*roles.Role)
@@ -348,14 +348,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -365,10 +367,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -377,7 +381,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]roles.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]roles.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *roles.Client, _ uint32, _ []roles.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/scopescmd/funcs.go b/internal/cmd/commands/scopescmd/funcs.go
index 6e7c940d3..4660b9122 100644
--- a/internal/cmd/commands/scopescmd/funcs.go
+++ b/internal/cmd/commands/scopescmd/funcs.go
@@ -45,7 +45,7 @@ func extraFlagsFuncImpl(c *Command, set *base.FlagSets, f *base.FlagSet) {
 	}
 }
 
-func extraFlagsHandlingFuncImpl(c *Command, opts *[]scopes.Option) int {
+func extraFlagsHandlingFuncImpl(c *Command, opts *[]scopes.Option) bool {
 	if c.flagSkipAdminRoleCreation {
 		*opts = append(*opts, scopes.WithSkipAdminRoleCreation(c.flagSkipAdminRoleCreation))
 	}
@@ -53,7 +53,7 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]scopes.Option) int {
 		*opts = append(*opts, scopes.WithSkipDefaultRoleCreation(c.flagSkipDefaultRoleCreation))
 	}
 
-	return 0
+	return true
 }
 
 func (c *Command) printListTable(items []*scopes.Scope) string {
diff --git a/internal/cmd/commands/scopescmd/scopes.gen.go b/internal/cmd/commands/scopescmd/scopes.gen.go
index 1bf4179ca..66a91ea26 100644
--- a/internal/cmd/commands/scopescmd/scopes.gen.go
+++ b/internal/cmd/commands/scopescmd/scopes.gen.go
@@ -139,12 +139,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []scopes.Option
@@ -155,13 +155,13 @@ func (c *Command) Run(args []string) int {
 		case "create":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 
 		case "list":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 
 		}
@@ -170,7 +170,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	scopesClient := scopes.NewClient(client)
 
@@ -211,8 +211,8 @@ func (c *Command) Run(args []string) int {
 		}
 	}
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -249,19 +249,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -282,7 +282,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*scopes.Scope)
@@ -298,14 +298,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -315,10 +317,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -327,7 +331,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]scopes.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]scopes.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *scopes.Client, _ uint32, _ []scopes.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/server/server.go b/internal/cmd/commands/server/server.go
index b20f009b5..372f90abd 100644
--- a/internal/cmd/commands/server/server.go
+++ b/internal/cmd/commands/server/server.go
@@ -147,7 +147,7 @@ func (c *Command) Run(args []string) int {
 
 	if err := c.SetupLogging(c.flagLogLevel, c.flagLogFormat, c.Config.LogLevel, c.Config.LogFormat); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	base.StartMemProfiler(c.Logger)
@@ -155,23 +155,23 @@ func (c *Command) Run(args []string) int {
 	if !c.skipMetrics {
 		if err := c.SetupMetrics(c.UI, c.Config.Telemetry); err != nil {
 			c.UI.Error(err.Error())
-			return 1
+			return base.CommandUserError
 		}
 	}
 
 	if err := c.SetupKMSes(c.UI, c.Config); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 	if c.Config.Controller != nil {
 		if c.RootKms == nil {
 			c.UI.Error("Root KMS not found after parsing KMS blocks")
-			return 1
+			return base.CommandUserError
 		}
 	}
 	if c.WorkerAuthKms == nil {
 		c.UI.Error("Worker Auth KMS not found after parsing KMS blocks")
-		return 1
+		return base.CommandUserError
 	}
 
 	if c.Config.DefaultMaxRequestDuration != 0 {
@@ -198,7 +198,7 @@ func (c *Command) Run(args []string) int {
 		switch len(lnConfig.Purpose) {
 		case 0:
 			c.UI.Error("Listener specified without a purpose")
-			return 1
+			return base.CommandUserError
 
 		case 1:
 			purpose := lnConfig.Purpose[0]
@@ -218,26 +218,26 @@ func (c *Command) Run(args []string) int {
 				}
 			default:
 				c.UI.Error(fmt.Sprintf("Unknown listener purpose %q", lnConfig.Purpose[0]))
-				return 1
+				return base.CommandUserError
 			}
 
 		default:
 			c.UI.Error("Specifying a listener with more than one purpose is not supported")
-			return 1
+			return base.CommandUserError
 		}
 	}
 	if c.Config.Controller != nil {
 		if !foundApi {
 			c.UI.Error(`Config activates controller but no listener with "api" purpose found`)
-			return 1
+			return base.CommandUserError
 		}
 		if clusterAddr == "" {
 			c.UI.Error(`Config activates controller but no listener with "cluster" purpose found`)
-			return 1
+			return base.CommandUserError
 		}
 		if err := c.SetupControllerPublicClusterAddress(c.Config, ""); err != nil {
 			c.UI.Error(err.Error())
-			return 1
+			return base.CommandUserError
 		}
 		c.InfoKeys = append(c.InfoKeys, "controller public cluster addr")
 		c.Info["controller public cluster addr"] = c.Config.Controller.PublicClusterAddr
@@ -246,13 +246,13 @@ func (c *Command) Run(args []string) int {
 	if c.Config.Worker != nil {
 		if !foundProxy {
 			c.UI.Error(`Config activates worker but no listener with "proxy" purpose found`)
-			return 1
+			return base.CommandUserError
 		}
 
 		if c.Config.Worker != nil {
 			if err := c.SetupWorkerPublicAddress(c.Config, ""); err != nil {
 				c.UI.Error(err.Error())
-				return 1
+				return base.CommandUserError
 			}
 			c.InfoKeys = append(c.InfoKeys, "worker public proxy addr")
 			c.Info["worker public proxy addr"] = c.Config.Worker.PublicAddr
@@ -289,7 +289,7 @@ func (c *Command) Run(args []string) int {
 				fallthrough
 			default:
 				c.UI.Error(`When running a combined controller and worker, it's invalid to specify a "controllers" key in the worker block with any value other than the controller cluster address/port when using IPs rather than DNS names`)
-				return 1
+				return base.CommandUserError
 			}
 		}
 		for _, controller := range c.Config.Worker.Controllers {
@@ -299,7 +299,7 @@ func (c *Command) Run(args []string) int {
 					host = controller
 				} else {
 					c.UI.Error(fmt.Errorf("Invalid controller address %q: %w", controller, err).Error())
-					return 1
+					return base.CommandUserError
 				}
 			}
 			ip := net.ParseIP(host)
@@ -313,14 +313,14 @@ func (c *Command) Run(args []string) int {
 				}
 				if errMsg != "" {
 					c.UI.Error(fmt.Sprintf("Controller address %q is invalid: cannot be %s address", controller, errMsg))
-					return 1
+					return base.CommandUserError
 				}
 			}
 		}
 	}
 	if err := c.SetupListeners(c.UI, c.Config.SharedConfig, []string{"api", "cluster", "proxy"}); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	if c.Config.Controller != nil {
@@ -335,14 +335,14 @@ func (c *Command) Run(args []string) int {
 						host = ln.Address
 					} else {
 						c.UI.Error(fmt.Errorf("Invalid cluster listener address %q: %w", ln.Address, err).Error())
-						return 1
+						return base.CommandUserError
 					}
 				}
 				ip := net.ParseIP(host)
 				if ip != nil {
 					if ip.IsUnspecified() && c.Config.Controller.PublicClusterAddr == "" {
 						c.UI.Error(fmt.Sprintf("When %q listener has an unspecified address, %q must be set", "cluster", "public_cluster_addr"))
-						return 1
+						return base.CommandUserError
 					}
 				}
 			}
@@ -352,34 +352,34 @@ func (c *Command) Run(args []string) int {
 	// Write out the PID to the file now that server has successfully started
 	if err := c.StorePidFile(c.Config.PidFile); err != nil {
 		c.UI.Error(fmt.Errorf("Error storing PID: %w", err).Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	if c.Config.Controller != nil {
 		if c.Config.Controller.Database == nil || c.Config.Controller.Database.Url == "" {
 			c.UI.Error(`"url" not specified in "controller.database" config block"`)
-			return 1
+			return base.CommandUserError
 		}
 		var err error
 		c.DatabaseUrl, err = config.ParseAddress(c.Config.Controller.Database.Url)
 		if err != nil && err != config.ErrNotAUrl {
 			c.UI.Error(fmt.Errorf("Error parsing database url: %w", err).Error())
-			return 1
+			return base.CommandUserError
 		}
 		if err := c.ConnectToDatabase("postgres"); err != nil {
 			c.UI.Error(fmt.Errorf("Error connecting to database: %w", err).Error())
-			return 1
+			return base.CommandCliError
 		}
 
 		sMan, err := schema.NewManager(c.Context, "postgres", c.Database.DB())
 		if err != nil {
 			c.UI.Error(fmt.Errorf("Can't get schema manager: %w.", err).Error())
-			return 1
+			return base.CommandCliError
 		}
 		// This is an advisory locks on the DB which is released when the db session ends.
 		if err := sMan.SharedLock(c.Context); err != nil {
 			c.UI.Error(fmt.Errorf("Unable to gain shared access to the database: %w", err).Error())
-			return 1
+			return base.CommandCliError
 		}
 		defer func() {
 			// The base context has already been cancelled so we shouldn't use it here.
@@ -395,29 +395,29 @@ func (c *Command) Run(args []string) int {
 		ckState, err := sMan.CurrentState(c.Context)
 		if err != nil {
 			c.UI.Error(fmt.Errorf("Error checking schema state: %w", err).Error())
-			return 1
+			return base.CommandCliError
 		}
 		if !ckState.InitializationStarted {
 			c.UI.Error(base.WrapAtLength("The database has not been initialized. Please run 'boundary database init'."))
-			return 1
+			return base.CommandCliError
 		}
 		if ckState.Dirty {
 			c.UI.Error(base.WrapAtLength("Database is in a bad state. Please revert the database into the last known good state."))
-			return 1
+			return base.CommandCliError
 		}
 		if ckState.BinarySchemaVersion > ckState.DatabaseSchemaVersion {
 			c.UI.Error(base.WrapAtLength("Database schema must be updated to use this version. Run 'boundary database migrate' to update the database. NOTE: Boundary does not currently support live migration; ensure all controllers are shut down before running the migration command."))
-			return 1
+			return base.CommandCliError
 		}
 		if ckState.BinarySchemaVersion < ckState.DatabaseSchemaVersion {
 			c.UI.Error(base.WrapAtLength(fmt.Sprintf("Newer schema version (%d) "+
 				"than this binary expects. Please use a newer version of the boundary "+
 				"binary.", ckState.DatabaseSchemaVersion)))
-			return 1
+			return base.CommandCliError
 		}
 		if err := c.verifyKmsSetup(); err != nil {
 			c.UI.Error(base.WrapAtLength("Database is in a bad state. Please revert the database into the last known good state."))
-			return 1
+			return base.CommandCliError
 		}
 	}
 
@@ -433,7 +433,7 @@ func (c *Command) Run(args []string) int {
 	if c.Config.Controller != nil {
 		if err := c.StartController(); err != nil {
 			c.UI.Error(err.Error())
-			return 1
+			return base.CommandCliError
 		}
 	}
 
@@ -443,7 +443,7 @@ func (c *Command) Run(args []string) int {
 			if err := c.controller.Shutdown(false); err != nil {
 				c.UI.Error(fmt.Errorf("Error with controller shutdown: %w", err).Error())
 			}
-			return 1
+			return base.CommandCliError
 		}
 	}
 
@@ -462,12 +462,12 @@ func (c *Command) ParseFlagsAndConfig(args []string) int {
 
 	if err = f.Parse(args); err != nil {
 		c.UI.Error(err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	if len(c.flagConfig) == 0 && c.presetConfig == nil {
 		c.UI.Error("Must specify a config file using -config")
-		return 1
+		return base.CommandUserError
 	}
 
 	switch {
@@ -484,13 +484,13 @@ func (c *Command) ParseFlagsAndConfig(args []string) int {
 			configWrapper, err = wrapper.GetWrapperFromPath(wrapperPath, "config")
 			if err != nil {
 				c.UI.Error(err.Error())
-				return 1
+				return base.CommandUserError
 			}
 			if configWrapper != nil {
 				c.configWrapper = configWrapper
 				if err := configWrapper.Init(c.Context); err != nil {
 					c.UI.Error(fmt.Errorf("Could not initialize kms: %w", err).Error())
-					return 1
+					return base.CommandCliError
 				}
 			}
 		}
@@ -498,23 +498,23 @@ func (c *Command) ParseFlagsAndConfig(args []string) int {
 	}
 	if err != nil {
 		c.UI.Error("Error parsing config: " + err.Error())
-		return 1
+		return base.CommandUserError
 	}
 
 	if c.Config.Controller == nil && c.Config.Worker == nil {
 		c.UI.Error("Neither worker nor controller specified in configuration file.")
-		return 1
+		return base.CommandUserError
 	}
 	if c.Config.Controller != nil && c.Config.Controller.Name == "" {
 		c.UI.Error("Controller has no name set. It must be the unique name of this instance.")
-		return 1
+		return base.CommandUserError
 	}
 	if c.Config.Worker != nil && c.Config.Worker.Name == "" {
 		c.UI.Error("Worker has no name set. It must be the unique name of this instance.")
-		return 1
+		return base.CommandUserError
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 func (c *Command) StartController() error {
@@ -648,7 +648,7 @@ func (c *Command) WaitForInterrupt() int {
 		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 func (c *Command) Reload(newConf *config.Config) error {
diff --git a/internal/cmd/commands/sessionscmd/sessions.gen.go b/internal/cmd/commands/sessionscmd/sessions.gen.go
index 7936d29e6..7a16e39e6 100644
--- a/internal/cmd/commands/sessionscmd/sessions.gen.go
+++ b/internal/cmd/commands/sessionscmd/sessions.gen.go
@@ -121,12 +121,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []sessions.Option
@@ -136,7 +136,7 @@ func (c *Command) Run(args []string) int {
 		case "list":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -144,7 +144,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	sessionsClient := sessions.NewClient(client)
 
@@ -169,8 +169,8 @@ func (c *Command) Run(args []string) int {
 		}
 	}
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	var result api.GenericResult
@@ -192,19 +192,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -222,14 +222,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 	}
 
 	item := result.GetItem().(*sessions.Session)
@@ -238,10 +240,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -250,7 +254,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]sessions.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]sessions.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *sessions.Client, _ uint32, _ []sessions.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/targetscmd/funcs.go b/internal/cmd/commands/targetscmd/funcs.go
index becf0848b..031840db6 100644
--- a/internal/cmd/commands/targetscmd/funcs.go
+++ b/internal/cmd/commands/targetscmd/funcs.go
@@ -203,7 +203,7 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 	}
 }
 
-func extraFlagsHandlingFuncImpl(c *Command, opts *[]targets.Option) int {
+func extraFlagsHandlingFuncImpl(c *Command, opts *[]targets.Option) bool {
 	// This is custom logic because of the authorized-session handling. If we
 	// support all resources to be looked up by name + scope info we can
 	// eventually graduate this out to the main template.
@@ -214,17 +214,17 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]targets.Option) int {
 				(c.FlagName == "" ||
 					(c.FlagScopeId == "" && c.FlagScopeName == "")) {
 				c.UI.Error("ID was not passed in, but no combination of name and scope ID/name was passed in either")
-				return 1
+				return false
 			}
 			if c.FlagId != "" &&
 				(c.FlagName != "" || c.FlagScopeId != "" || c.FlagScopeName != "") {
 				c.UI.Error("Cannot specify a target ID and also other lookup parameters")
-				return 1
+				return false
 			}
 		default:
 			if c.FlagId == "" {
 				c.UI.Error("ID is required but not passed in via -id")
-				return 1
+				return false
 			}
 		}
 	}
@@ -237,14 +237,14 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]targets.Option) int {
 	case "add-host-sets", "remove-host-sets":
 		if len(c.flagHostSets) == 0 {
 			c.UI.Error("No host-sets supplied via -host-set")
-			return 1
+			return false
 		}
 
 	case "set-host-sets":
 		switch len(c.flagHostSets) {
 		case 0:
 			c.UI.Error("No host-sets supplied via -host-set")
-			return 1
+			return false
 		case 1:
 			if c.flagHostSets[0] == "null" {
 				c.flagHostSets = nil
@@ -257,7 +257,7 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]targets.Option) int {
 		}
 	}
 
-	return 0
+	return true
 }
 
 func executeExtraActionsImpl(c *Command, origResult api.GenericResult, origError error, targetClient *targets.Client, version uint32, opts []targets.Option) (api.GenericResult, error) {
diff --git a/internal/cmd/commands/targetscmd/targets.gen.go b/internal/cmd/commands/targetscmd/targets.gen.go
index 083c4e423..bce3b013f 100644
--- a/internal/cmd/commands/targetscmd/targets.gen.go
+++ b/internal/cmd/commands/targetscmd/targets.gen.go
@@ -117,7 +117,7 @@ func (c *Command) Run(args []string) int {
 
 	if os.Getenv("BOUNDARY_EXAMPLE_CLI_OUTPUT") != "" {
 		c.UI.Output(exampleOutput())
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -139,7 +139,7 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []targets.Option
@@ -149,7 +149,7 @@ func (c *Command) Run(args []string) int {
 		case "list":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -157,7 +157,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	targetsClient := targets.NewClient(client)
 
@@ -216,8 +216,8 @@ func (c *Command) Run(args []string) int {
 
 	}
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -248,19 +248,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -281,7 +281,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*targets.Target)
@@ -297,14 +297,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -314,10 +316,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -326,7 +330,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]targets.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]targets.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *targets.Client, _ uint32, _ []targets.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/targetscmd/tcp_funcs.go b/internal/cmd/commands/targetscmd/tcp_funcs.go
index cb9dc0c29..f54785557 100644
--- a/internal/cmd/commands/targetscmd/tcp_funcs.go
+++ b/internal/cmd/commands/targetscmd/tcp_funcs.go
@@ -91,7 +91,7 @@ func extraTcpFlagsFuncImpl(c *TcpCommand, set *base.FlagSets, f *base.FlagSet) {
 	}
 }
 
-func extraTcpFlagsHandlingFuncImpl(c *TcpCommand, opts *[]targets.Option) int {
+func extraTcpFlagsHandlingFuncImpl(c *TcpCommand, opts *[]targets.Option) bool {
 	switch c.flagDefaultPort {
 	case "":
 	case "null":
@@ -100,7 +100,7 @@ func extraTcpFlagsHandlingFuncImpl(c *TcpCommand, opts *[]targets.Option) int {
 		port, err := strconv.ParseUint(c.flagDefaultPort, 10, 32)
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("Error parsing %q: %s", c.flagDefaultPort, err))
-			return 1
+			return false
 		}
 		*opts = append(*opts, targets.WithTcpTargetDefaultPort(uint32(port)))
 	}
@@ -118,7 +118,7 @@ func extraTcpFlagsHandlingFuncImpl(c *TcpCommand, opts *[]targets.Option) int {
 			dur, err := time.ParseDuration(c.flagSessionMaxSeconds)
 			if err != nil {
 				c.UI.Error(fmt.Sprintf("Error parsing %q: %s", c.flagSessionMaxSeconds, err))
-				return 1
+				return false
 			}
 			final = uint32(dur.Seconds())
 		}
@@ -133,7 +133,7 @@ func extraTcpFlagsHandlingFuncImpl(c *TcpCommand, opts *[]targets.Option) int {
 		limit, err := strconv.ParseInt(c.flagSessionConnectionLimit, 10, 32)
 		if err != nil {
 			c.UI.Error(fmt.Sprintf("Error parsing %q: %s", c.flagSessionConnectionLimit, err))
-			return 1
+			return false
 		}
 		*opts = append(*opts, targets.WithSessionConnectionLimit(int32(limit)))
 	}
@@ -145,10 +145,10 @@ func extraTcpFlagsHandlingFuncImpl(c *TcpCommand, opts *[]targets.Option) int {
 	default:
 		if _, err := bexpr.CreateEvaluator(c.flagWorkerFilter); err != nil {
 			c.UI.Error(fmt.Sprintf("Unable to successfully parse filter expression: %s", err))
-			return 1
+			return false
 		}
 		*opts = append(*opts, targets.WithWorkerFilter(c.flagWorkerFilter))
 	}
 
-	return 0
+	return true
 }
diff --git a/internal/cmd/commands/targetscmd/tcp_targets.gen.go b/internal/cmd/commands/targetscmd/tcp_targets.gen.go
index 12c351c18..55f199804 100644
--- a/internal/cmd/commands/targetscmd/tcp_targets.gen.go
+++ b/internal/cmd/commands/targetscmd/tcp_targets.gen.go
@@ -116,12 +116,12 @@ func (c *TcpCommand) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsTcpMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []targets.Option
@@ -131,7 +131,7 @@ func (c *TcpCommand) Run(args []string) int {
 		case "create":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		}
 	}
@@ -139,7 +139,7 @@ func (c *TcpCommand) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	targetsClient := targets.NewClient(client)
 
@@ -180,8 +180,8 @@ func (c *TcpCommand) Run(args []string) int {
 		}
 	}
 
-	if ret := extraTcpFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraTcpFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	var result api.GenericResult
@@ -201,19 +201,19 @@ func (c *TcpCommand) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomTcpActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -225,17 +225,19 @@ func (c *TcpCommand) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
 	extraTcpActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraTcpSynopsisFunc        = func(*TcpCommand) string { return "" }
 	extraTcpFlagsFunc           = func(*TcpCommand, *base.FlagSets, *base.FlagSet) {}
-	extraTcpFlagsHandlingFunc   = func(*TcpCommand, *[]targets.Option) int { return 0 }
+	extraTcpFlagsHandlingFunc   = func(*TcpCommand, *[]targets.Option) bool { return true }
 	executeExtraTcpActions      = func(_ *TcpCommand, inResult api.GenericResult, inErr error, _ *targets.Client, _ uint32, _ []targets.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/userscmd/funcs.go b/internal/cmd/commands/userscmd/funcs.go
index c0b6ef559..57fc3a091 100644
--- a/internal/cmd/commands/userscmd/funcs.go
+++ b/internal/cmd/commands/userscmd/funcs.go
@@ -104,19 +104,19 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 	}
 }
 
-func extraFlagsHandlingFuncImpl(c *Command, opts *[]users.Option) int {
+func extraFlagsHandlingFuncImpl(c *Command, opts *[]users.Option) bool {
 	switch c.Func {
 	case "add-accounts", "remove-accounts":
 		if len(c.flagAccounts) == 0 {
 			c.UI.Error("No accounts supplied via -account")
-			return 1
+			return false
 		}
 
 	case "set-accounts":
 		switch len(c.flagAccounts) {
 		case 0:
 			c.UI.Error("No accounts supplied via -account")
-			return 1
+			return false
 		case 1:
 			if c.flagAccounts[0] == "null" {
 				c.flagAccounts = nil
@@ -124,7 +124,7 @@ func extraFlagsHandlingFuncImpl(c *Command, opts *[]users.Option) int {
 		}
 	}
 
-	return 0
+	return true
 }
 
 func executeExtraActionsImpl(c *Command, origResult api.GenericResult, origError error, userClient *users.Client, version uint32, opts []users.Option) (api.GenericResult, error) {
diff --git a/internal/cmd/commands/userscmd/users.gen.go b/internal/cmd/commands/userscmd/users.gen.go
index 5e2890d89..8a158c558 100644
--- a/internal/cmd/commands/userscmd/users.gen.go
+++ b/internal/cmd/commands/userscmd/users.gen.go
@@ -139,12 +139,12 @@ func (c *Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	if strutil.StrListContains(flagsMap[c.Func], "id") && c.FlagId == "" {
 		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-		return 1
+		return base.CommandUserError
 	}
 
 	var opts []users.Option
@@ -155,13 +155,13 @@ func (c *Command) Run(args []string) int {
 		case "create":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 
 		case "list":
 			if c.FlagScopeId == "" {
 				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
-				return 1
+				return base.CommandUserError
 			}
 
 		}
@@ -170,7 +170,7 @@ func (c *Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	usersClient := users.NewClient(client)
 
@@ -237,8 +237,8 @@ func (c *Command) Run(args []string) int {
 
 	}
 
-	if ret := extraFlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extraFlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	existed := true
@@ -275,19 +275,19 @@ func (c *Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustomActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -308,7 +308,7 @@ func (c *Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	case "list":
 		listedItems := listResult.GetItems().([]*users.User)
@@ -324,14 +324,16 @@ func (c *Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 
 	}
 
@@ -341,10 +343,12 @@ func (c *Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -353,7 +357,7 @@ var (
 	extraActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extraSynopsisFunc        = func(*Command) string { return "" }
 	extraFlagsFunc           = func(*Command, *base.FlagSets, *base.FlagSet) {}
-	extraFlagsHandlingFunc   = func(*Command, *[]users.Option) int { return 0 }
+	extraFlagsHandlingFunc   = func(*Command, *[]users.Option) bool { return true }
 	executeExtraActions      = func(_ *Command, inResult api.GenericResult, inErr error, _ *users.Client, _ uint32, _ []users.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/cmd/commands/version/version.go b/internal/cmd/commands/version/version.go
index 2d3c130a7..cba5b4733 100644
--- a/internal/cmd/commands/version/version.go
+++ b/internal/cmd/commands/version/version.go
@@ -51,10 +51,10 @@ func (c *Command) Run(args []string) int {
 		b, err := base.JsonFormatter{}.Format(verInfo)
 		if err != nil {
 			c.UI.Error(fmt.Errorf("Error formatting as JSON: %w", err).Error())
-			return 1
+			return base.CommandApiError
 		}
 		c.UI.Output(string(b))
-		return 0
+		return base.CommandSuccess
 	}
 
 	nonAttributeMap := map[string]interface{}{}
@@ -79,5 +79,5 @@ func (c *Command) Run(args []string) int {
 
 	c.UI.Output(base.WrapForHelpText(ret))
 
-	return 0
+	return base.CommandSuccess
 }
diff --git a/internal/cmd/gencli/templates.go b/internal/cmd/gencli/templates.go
index 10eae97e4..054966163 100644
--- a/internal/cmd/gencli/templates.go
+++ b/internal/cmd/gencli/templates.go
@@ -208,7 +208,7 @@ func (c *{{ camelCase .SubActionPrefix }}Command) Run(args []string) int {
 	{{ if .HasExampleCliOutput }}
 	if os.Getenv("BOUNDARY_EXAMPLE_CLI_OUTPUT") != "" {
 		c.UI.Output(exampleOutput())
-		return 0
+		return base.CommandSuccess
 	}
 	{{ end }}
 
@@ -231,13 +231,13 @@ func (c *{{ camelCase .SubActionPrefix }}Command) Run(args []string) int {
 
 	if err := f.Parse(args); err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 
 	{{ if .HasId }}
 	if strutil.StrListContains(flags{{ camelCase .SubActionPrefix }}Map[c.Func], "id") && c.FlagId == "" {
 			c.PrintCliError(errors.New("ID is required but not passed in via -id"))
-			return 1
+			return base.CommandUserError
 	}
 	{{ end }}
 
@@ -249,14 +249,14 @@ func (c *{{ camelCase .SubActionPrefix }}Command) Run(args []string) int {
 		case "create":
 			if c.Flag{{ .Container }}Id == "" {
 				c.PrintCliError(errors.New("{{ .Container }} ID must be passed in via -{{ kebabCase .Container }}-id or BOUNDARY_{{ envCase .Container }}_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		{{ end }}
 		{{ if hasAction .StdActions "list" }}
 		case "list":
 			if c.Flag{{ .Container }}Id == "" {
 				c.PrintCliError(errors.New("{{ .Container }} ID must be passed in via -{{ kebabCase .Container }}-id or BOUNDARY_{{ envCase .Container }}_ID"))
-				return 1
+				return base.CommandUserError
 			}
 		{{ end }}
 		}
@@ -265,7 +265,7 @@ func (c *{{ camelCase .SubActionPrefix }}Command) Run(args []string) int {
 	client, err := c.Client()
 	if err != nil {
 		c.PrintCliError(fmt.Errorf("Error creating API client: %s", err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 	{{ .Pkg }}Client := {{ .Pkg }}.NewClient(client)
 
@@ -323,8 +323,8 @@ func (c *{{ camelCase .SubActionPrefix }}Command) Run(args []string) int {
 	}
 	{{ end }}
 
-	if ret := extra{{ camelCase .SubActionPrefix }}FlagsHandlingFunc(c, &opts); ret != 0 {
-		return ret
+	if ok := extra{{ camelCase .SubActionPrefix }}FlagsHandlingFunc(c, &opts); !ok {
+		return base.CommandUserError
 	}
 
 	{{ if hasAction .StdActions "delete" }}
@@ -369,19 +369,19 @@ func (c *{{ camelCase .SubActionPrefix }}Command) Run(args []string) int {
 	if err != nil {
 		if apiErr := api.AsServerError(err); apiErr != nil {
 			c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
-			return 1
+			return base.CommandApiError
 		}
 		c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
-		return 2
+		return base.CommandCliError
 	}
 
 	output, err := printCustom{{ camelCase .SubActionPrefix }}ActionOutput(c)
 	if err != nil {
 		c.PrintCliError(err)
-		return 1
+		return base.CommandUserError
 	}
 	if output {
-		return 0
+		return base.CommandSuccess
 	}
 
 	switch c.Func {
@@ -403,7 +403,7 @@ func (c *{{ camelCase .SubActionPrefix }}Command) Run(args []string) int {
 			c.UI.Output(output)
 		}
 
-		return 0
+		return base.CommandSuccess
 	{{ end }}
 	{{ if eq $action "list" }}
 	case "list":
@@ -420,14 +420,16 @@ func (c *{{ camelCase .SubActionPrefix }}Command) Run(args []string) int {
 				for i, v := range listedItems {
 					items[i] = v
 				}
-				return c.PrintJsonItems(listResult, items)
+				if ok := c.PrintJsonItems(listResult, items); !ok {
+					return base.CommandCliError
+				}
 			}
 
 		case "table":
 			c.UI.Output(c.printListTable(listedItems))
 		}
 
-		return 0
+		return base.CommandSuccess
 	{{ end }}
 	{{ end }}
 	}
@@ -438,10 +440,12 @@ func (c *{{ camelCase .SubActionPrefix }}Command) Run(args []string) int {
 		c.UI.Output(printItemTable(item))
 
 	case "json":
-		return c.PrintJsonItem(result, item)
+		if ok := c.PrintJsonItem(result, item); !ok {
+			return base.CommandCliError
+		}
 	}
 
-	return 0
+	return base.CommandSuccess
 }
 
 var (
@@ -451,7 +455,7 @@ var (
 	extra{{ camelCase .SubActionPrefix }}ActionsFlagsMapFunc = func() map[string][]string { return nil }
 	extra{{ camelCase .SubActionPrefix }}SynopsisFunc = func(*{{ camelCase .SubActionPrefix }}Command) string { return "" }
 	extra{{ camelCase .SubActionPrefix }}FlagsFunc = func(*{{ camelCase .SubActionPrefix }}Command, *base.FlagSets, *base.FlagSet) {}
-	extra{{ camelCase .SubActionPrefix }}FlagsHandlingFunc = func(*{{ camelCase .SubActionPrefix }}Command, *[]{{ .Pkg }}.Option) int { return 0 }
+	extra{{ camelCase .SubActionPrefix }}FlagsHandlingFunc = func(*{{ camelCase .SubActionPrefix }}Command, *[]{{ .Pkg }}.Option) bool { return true }
 	executeExtra{{ camelCase .SubActionPrefix }}Actions = func(_ *{{ camelCase .SubActionPrefix }}Command, inResult api.GenericResult, inErr error, _ *{{ .Pkg }}.Client, _ uint32, _ []{{ .Pkg }}.Option) (api.GenericResult, error) {
 		return inResult, inErr
 	}
diff --git a/internal/tests/cli/boundary/groups.bats b/internal/tests/cli/boundary/groups.bats
index 51b650671..498b95da3 100644
--- a/internal/tests/cli/boundary/groups.bats
+++ b/internal/tests/cli/boundary/groups.bats
@@ -62,13 +62,6 @@ export NEW_GROUP='test'
   [ "$status" -eq 0 ]
 }
 
-@test "boundary/group: can not delete already deleted $NEW_GROUP group" {
-  local gid=$(group_id $NEW_GROUP)
-  run delete_group $gid 
-  echo "$output"
-  [ "$status" -eq 1 ]
-}
-
 @test "boundary/groups: can not read deleted $NEW_GROUP group" {
   local gid=$(group_id $NEW_GROUP)
 	run read_group $gid
diff --git a/internal/tests/cli/boundary/host_catalogs.bats b/internal/tests/cli/boundary/host_catalogs.bats
index 4a29e44cc..3e3630429 100644
--- a/internal/tests/cli/boundary/host_catalogs.bats
+++ b/internal/tests/cli/boundary/host_catalogs.bats
@@ -47,13 +47,6 @@ export NEW_HOST_CATALOG='test'
   [ "$status" -eq 0 ]
 }
 
-@test "boundary/host-catalogs: can not delete already deleted $NEW_HOST_CATALOG host in default project scope" {
-  local hid=$(host_catalog_id $NEW_HOST_CATALOG $DEFAULT_P_ID)
-  run delete_host_catalog $hid 
-  echo "$output"
-  [ "$status" -eq 1 ]
-}
-
 @test "boundary/host-catalogs: can not read deleted $NEW_HOST_CATALOG host in default project scope" {
   local hid=$(host_catalog_id $NEW_HOST_CATALOG $DEFAULT_P_ID)
 	run read_host_catalog $hid
diff --git a/internal/tests/cli/boundary/hosts.bats b/internal/tests/cli/boundary/hosts.bats
index 93ede705a..f25e15880 100644
--- a/internal/tests/cli/boundary/hosts.bats
+++ b/internal/tests/cli/boundary/hosts.bats
@@ -19,7 +19,7 @@ export NEW_HOST='test'
 }
 
 @test "boundary/hosts: can not add already created $NEW_HOST host in default host catalog" {
-	run create_host $NEW_HOST
+	run create_host $NEW_HOST $DEFAULT_HOST_CATALOG
   echo "$output"
 	[ "$status" -eq 1 ]
 }
@@ -47,13 +47,6 @@ export NEW_HOST='test'
   [ "$status" -eq 0 ]
 }
 
-@test "boundary/host: can not delete already deleted $NEW_HOST host" {
-  local hid=$(host_id $NEW_HOST $DEFAULT_HOST_CATALOG)
-  run delete_host $hid 
-  echo "$output"
-  [ "$status" -eq 1 ]
-}
-
 @test "boundary/hosts: can not read deleted $NEW_HOST host" {
   local hid=$(host_id $NEW_HOST $DEFAULT_HOST_CATALOG)
 	run read_host $hid
diff --git a/internal/tests/cli/boundary/roles.bats b/internal/tests/cli/boundary/roles.bats
index 7eaa2ed8b..3dad1416c 100644
--- a/internal/tests/cli/boundary/roles.bats
+++ b/internal/tests/cli/boundary/roles.bats
@@ -107,13 +107,6 @@ export NEW_GRANT='id=*;type=*;actions=create,read,update,delete,list'
   [ "$status" -eq 0 ]
 }
 
-@test "boundary/role: can not delete already deleted $NEW_ROLE role" {
-  local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
-  run delete_role $rid 
-  echo "$output"
-  [ "$status" -eq 1 ]
-}
-
 @test "boundary/roles: can not read deleted $NEW_ROLE role" {
   local rid=$(role_id $NEW_ROLE $DEFAULT_GLOBAL)
 	run read_role $rid
diff --git a/internal/tests/cli/boundary/user.bats b/internal/tests/cli/boundary/user.bats
index 6be001a53..d62cb26a9 100644
--- a/internal/tests/cli/boundary/user.bats
+++ b/internal/tests/cli/boundary/user.bats
@@ -91,12 +91,6 @@ export NEW_USER='test'
   [ "$status" -eq 0 ]
 }
 
-@test "boundary/account/password: can not delete already deleted $NEW_USER account" {
-  local aid=$(account_id $NEW_USER)
-  run delete_account $aid 
-  [ "$status" -eq 1 ]
-}
-
 @test "boundary/account/password: can not read deleted $NEW_USER account" {
   local aid=$(account_id $NEW_USER)
 	run read_account $aid