diff --git a/api4/command.go b/api4/command.go
index 27aa6aad07..74b1c8a592 100644
--- a/api4/command.go
+++ b/api4/command.go
@@ -332,8 +332,8 @@ func executeCommand(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	commandArgs.UserId = c.App.Session().UserId
 	commandArgs.T = c.App.T
-	commandArgs.Session = *c.App.Session()
 	commandArgs.SiteURL = c.GetSiteURLHeader()
+	commandArgs.Session = *c.App.Session()
 
 	auditRec.AddMeta("commandargs", commandArgs) // overwrite in case teamid changed
 
diff --git a/app/command_channel_header.go b/app/command_channel_header.go
index 5ddddac012..c148b84c4b 100644
--- a/app/command_channel_header.go
+++ b/app/command_channel_header.go
@@ -45,7 +45,7 @@ func (me *HeaderProvider) DoCommand(a *App, args *model.CommandArgs, message str
 
 	switch channel.Type {
 	case model.CHANNEL_OPEN:
-		if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
+		if !a.HasPermissionToChannel(args.UserId, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
 			return &model.CommandResponse{
 				Text:         args.T("api.command_channel_header.permission.app_error"),
 				ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL,
@@ -53,7 +53,7 @@ func (me *HeaderProvider) DoCommand(a *App, args *model.CommandArgs, message str
 		}
 
 	case model.CHANNEL_PRIVATE:
-		if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES) {
+		if !a.HasPermissionToChannel(args.UserId, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES) {
 			return &model.CommandResponse{
 				Text:         args.T("api.command_channel_header.permission.app_error"),
 				ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL,
@@ -63,7 +63,7 @@ func (me *HeaderProvider) DoCommand(a *App, args *model.CommandArgs, message str
 	case model.CHANNEL_GROUP, model.CHANNEL_DIRECT:
 		// Modifying the header is not linked to any specific permission for group/dm channels, so just check for membership.
 		var channelMember *model.ChannelMember
-		channelMember, err = a.GetChannelMember(args.ChannelId, args.Session.UserId)
+		channelMember, err = a.GetChannelMember(args.ChannelId, args.UserId)
 		if err != nil || channelMember == nil {
 			return &model.CommandResponse{
 				Text:         args.T("api.command_channel_header.permission.app_error"),
diff --git a/app/command_channel_header_test.go b/app/command_channel_header_test.go
index 0af2571ba1..531e1b7e8c 100644
--- a/app/command_channel_header_test.go
+++ b/app/command_channel_header_test.go
@@ -23,7 +23,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args := &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	for msg, expected := range map[string]string{
@@ -40,7 +40,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual := hp.DoCommand(th.App, args, "hello").Text
@@ -54,7 +54,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
@@ -66,7 +66,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
@@ -82,7 +82,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: groupChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    user1.Id,
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
@@ -92,7 +92,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: groupChannel.Id,
-		Session:   model.Session{UserId: user3.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    user3.Id,
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
@@ -104,7 +104,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: directChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
@@ -114,7 +114,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: directChannel.Id,
-		Session:   model.Session{UserId: user2.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    user2.Id,
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
diff --git a/app/command_channel_purpose.go b/app/command_channel_purpose.go
index dec699b45a..4b6e99f846 100644
--- a/app/command_channel_purpose.go
+++ b/app/command_channel_purpose.go
@@ -45,14 +45,14 @@ func (me *PurposeProvider) DoCommand(a *App, args *model.CommandArgs, message st
 
 	switch channel.Type {
 	case model.CHANNEL_OPEN:
-		if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
+		if !a.HasPermissionToChannel(args.UserId, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
 			return &model.CommandResponse{
 				Text:         args.T("api.command_channel_purpose.permission.app_error"),
 				ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL,
 			}
 		}
 	case model.CHANNEL_PRIVATE:
-		if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES) {
+		if !a.HasPermissionToChannel(args.UserId, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES) {
 			return &model.CommandResponse{
 				Text:         args.T("api.command_channel_purpose.permission.app_error"),
 				ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL,
diff --git a/app/command_channel_purpose_test.go b/app/command_channel_purpose_test.go
index 1c4b4070c7..1994f96c14 100644
--- a/app/command_channel_purpose_test.go
+++ b/app/command_channel_purpose_test.go
@@ -23,7 +23,7 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	args := &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	for msg, expected := range map[string]string{
@@ -40,7 +40,6 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual := pp.DoCommand(th.App, args, "hello").Text
@@ -54,7 +53,7 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = pp.DoCommand(th.App, args, "hello").Text
@@ -66,7 +65,6 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = pp.DoCommand(th.App, args, "hello").Text
@@ -81,7 +79,6 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: groupChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = pp.DoCommand(th.App, args, "hello").Text
@@ -93,7 +90,6 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: directChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = pp.DoCommand(th.App, args, "hello").Text
diff --git a/app/command_channel_rename.go b/app/command_channel_rename.go
index f08d8ab17d..f8cc76630c 100644
--- a/app/command_channel_rename.go
+++ b/app/command_channel_rename.go
@@ -48,14 +48,14 @@ func (me *RenameProvider) DoCommand(a *App, args *model.CommandArgs, message str
 
 	switch channel.Type {
 	case model.CHANNEL_OPEN:
-		if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
+		if !a.HasPermissionToChannel(args.UserId, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
 			return &model.CommandResponse{
 				Text:         args.T("api.command_channel_rename.permission.app_error"),
 				ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL,
 			}
 		}
 	case model.CHANNEL_PRIVATE:
-		if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES) {
+		if !a.HasPermissionToChannel(args.UserId, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES) {
 			return &model.CommandResponse{
 				Text:         args.T("api.command_channel_rename.permission.app_error"),
 				ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL,
diff --git a/app/command_channel_rename_test.go b/app/command_channel_rename_test.go
index 3cf81af855..73775bdf76 100644
--- a/app/command_channel_rename_test.go
+++ b/app/command_channel_rename_test.go
@@ -22,7 +22,7 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	args := &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	// Table Test for basic cases. Blank text in response indicates success
@@ -43,7 +43,7 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual := rp.DoCommand(th.App, args, "hello").Text
@@ -57,7 +57,7 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, "hello").Text
@@ -69,7 +69,7 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, "hello").Text
@@ -84,7 +84,7 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: groupChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, "hello").Text
@@ -96,7 +96,7 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: directChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, "hello").Text
diff --git a/app/command_groupmsg.go b/app/command_groupmsg.go
index 2b8c01120e..003c621bff 100644
--- a/app/command_groupmsg.go
+++ b/app/command_groupmsg.go
@@ -107,7 +107,7 @@ func (me *groupmsgProvider) DoCommand(a *App, args *model.CommandArgs, message s
 	var groupChannel *model.Channel
 	var channelErr *model.AppError
 
-	if a.SessionHasPermissionTo(args.Session, model.PERMISSION_CREATE_GROUP_CHANNEL) {
+	if a.HasPermissionTo(args.UserId, model.PERMISSION_CREATE_GROUP_CHANNEL) {
 		groupChannel, channelErr = a.CreateGroupChannel(targetUsersSlice, args.UserId)
 		if channelErr != nil {
 			mlog.Error(channelErr.Error())
diff --git a/app/command_groupmsg_test.go b/app/command_groupmsg_test.go
index d35b5a20cb..4258af87c2 100644
--- a/app/command_groupmsg_test.go
+++ b/app/command_groupmsg_test.go
@@ -64,21 +64,22 @@ func TestGroupMsgProvider(t *testing.T) {
 	th.LinkUserToTeam(th.BasicUser, team)
 	cmd := &groupmsgProvider{}
 
+	th.RemovePermissionFromRole(model.PERMISSION_CREATE_GROUP_CHANNEL.Id, model.SYSTEM_USER_ROLE_ID)
+
 	t.Run("Check without permission to create a GM channel.", func(t *testing.T) {
 		resp := cmd.DoCommand(th.App, &model.CommandArgs{
 			T:       i18n.IdentityTfunc(),
 			SiteURL: "http://test.url",
 			TeamId:  team.Id,
 			UserId:  th.BasicUser.Id,
-			Session: model.Session{
-				Roles: "",
-			},
 		}, targetUsers+"hello")
 
 		assert.Equal(t, "api.command_groupmsg.permission.app_error", resp.Text)
 		assert.Equal(t, "", resp.GotoLocation)
 	})
 
+	th.AddPermissionToRole(model.PERMISSION_CREATE_GROUP_CHANNEL.Id, model.SYSTEM_USER_ROLE_ID)
+
 	t.Run("Check without permissions to view a user in the list.", func(t *testing.T) {
 		th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
 		defer th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
@@ -87,9 +88,6 @@ func TestGroupMsgProvider(t *testing.T) {
 			SiteURL: "http://test.url",
 			TeamId:  team.Id,
 			UserId:  th.BasicUser.Id,
-			Session: model.Session{
-				Roles: model.SYSTEM_USER_ROLE_ID,
-			},
 		}, targetUsers+"hello")
 
 		assert.Equal(t, "api.command_groupmsg.invalid_user.app_error", resp.Text)
@@ -102,9 +100,6 @@ func TestGroupMsgProvider(t *testing.T) {
 			SiteURL: "http://test.url",
 			TeamId:  team.Id,
 			UserId:  th.BasicUser.Id,
-			Session: model.Session{
-				Roles: model.SYSTEM_USER_ROLE_ID,
-			},
 		}, targetUsers+"hello")
 
 		channelName := model.GetGroupNameFromUserIds([]string{th.BasicUser.Id, th.BasicUser2.Id, user3.Id})
@@ -118,9 +113,6 @@ func TestGroupMsgProvider(t *testing.T) {
 			SiteURL: "http://test.url",
 			TeamId:  team.Id,
 			UserId:  th.BasicUser.Id,
-			Session: model.Session{
-				Roles: "",
-			},
 		}, targetUsers+"hello")
 
 		channelName := model.GetGroupNameFromUserIds([]string{th.BasicUser.Id, th.BasicUser2.Id, user3.Id})
diff --git a/app/command_invite.go b/app/command_invite.go
index 1c96ca232f..deb92934f0 100644
--- a/app/command_invite.go
+++ b/app/command_invite.go
@@ -91,7 +91,7 @@ func (me *InviteProvider) DoCommand(a *App, args *model.CommandArgs, message str
 	// Permissions Check
 	switch channelToJoin.Type {
 	case model.CHANNEL_OPEN:
-		if !a.SessionHasPermissionToChannel(args.Session, channelToJoin.Id, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS) {
+		if !a.HasPermissionToChannel(args.UserId, channelToJoin.Id, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS) {
 			return &model.CommandResponse{
 				Text: args.T("api.command_invite.permission.app_error", map[string]interface{}{
 					"User":    userProfile.Username,
@@ -101,7 +101,7 @@ func (me *InviteProvider) DoCommand(a *App, args *model.CommandArgs, message str
 			}
 		}
 	case model.CHANNEL_PRIVATE:
-		if !a.SessionHasPermissionToChannel(args.Session, channelToJoin.Id, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS) {
+		if !a.HasPermissionToChannel(args.UserId, channelToJoin.Id, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS) {
 			if _, err = a.GetChannelMember(channelToJoin.Id, args.UserId); err == nil {
 				// User doing the inviting is a member of the channel.
 				return &model.CommandResponse{
@@ -139,7 +139,7 @@ func (me *InviteProvider) DoCommand(a *App, args *model.CommandArgs, message str
 		}
 	}
 
-	if _, err := a.AddChannelMember(userProfile.Id, channelToJoin, args.Session.UserId, ""); err != nil {
+	if _, err := a.AddChannelMember(userProfile.Id, channelToJoin, args.UserId, ""); err != nil {
 		var text string
 		if err.Id == "api.channel.add_members.user_denied" {
 			text = args.T("api.command_invite.group_constrained_user_denied")
diff --git a/app/command_invite_people.go b/app/command_invite_people.go
index b91e9074fa..17036b064f 100644
--- a/app/command_invite_people.go
+++ b/app/command_invite_people.go
@@ -41,11 +41,11 @@ func (me *InvitePeopleProvider) GetCommand(a *App, T goi18n.TranslateFunc) *mode
 }
 
 func (me *InvitePeopleProvider) DoCommand(a *App, args *model.CommandArgs, message string) *model.CommandResponse {
-	if !a.SessionHasPermissionToTeam(args.Session, args.TeamId, model.PERMISSION_INVITE_USER) {
+	if !a.HasPermissionToTeam(args.UserId, args.TeamId, model.PERMISSION_INVITE_USER) {
 		return &model.CommandResponse{Text: args.T("api.command_invite_people.permission.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
 	}
 
-	if !a.SessionHasPermissionToTeam(args.Session, args.TeamId, model.PERMISSION_ADD_USER_TO_TEAM) {
+	if !a.HasPermissionToTeam(args.UserId, args.TeamId, model.PERMISSION_ADD_USER_TO_TEAM) {
 		return &model.CommandResponse{Text: args.T("api.command_invite_people.permission.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
 	}
 
diff --git a/app/command_invite_people_test.go b/app/command_invite_people_test.go
index 10ca5a3094..599643bca1 100644
--- a/app/command_invite_people_test.go
+++ b/app/command_invite_people_test.go
@@ -22,20 +22,21 @@ func TestInvitePeopleProvider(t *testing.T) {
 
 	cmd := InvitePeopleProvider{}
 
+	notTeamUser := th.CreateUser()
+
 	// Test without required permissions
 	args := &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
 		TeamId:    th.BasicTeam.Id,
-		UserId:    th.BasicUser.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		UserId:    notTeamUser.Id,
 	}
 
 	actual := cmd.DoCommand(th.App, args, model.NewId()+"@simulator.amazonses.com")
 	assert.Equal(t, "api.command_invite_people.permission.app_error", actual.Text)
 
 	// Test with required permissions.
-	args.Session.TeamMembers[0].Roles = model.TEAM_USER_ROLE_ID
+	args.UserId = th.BasicUser.Id
 	actual = cmd.DoCommand(th.App, args, model.NewId()+"@simulator.amazonses.com")
 	assert.Equal(t, "api.command.invite_people.sent", actual.Text)
 }
diff --git a/app/command_invite_test.go b/app/command_invite_test.go
index 53949cb03f..e0b3702101 100644
--- a/app/command_invite_test.go
+++ b/app/command_invite_test.go
@@ -60,7 +60,7 @@ func TestInviteProvider(t *testing.T) {
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
 		TeamId:    th.BasicTeam.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	userAndWrongChannel := "@" + th.BasicUser2.Username + " wrongchannel1"
@@ -197,7 +197,7 @@ func TestInviteGroup(t *testing.T) {
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
 		TeamId:    th.BasicTeam.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	tests := []struct {
diff --git a/app/command_join.go b/app/command_join.go
index fe8a46c910..92b03cf875 100644
--- a/app/command_join.go
+++ b/app/command_join.go
@@ -53,11 +53,11 @@ func (me *JoinProvider) DoCommand(a *App, args *model.CommandArgs, message strin
 
 	switch channel.Type {
 	case model.CHANNEL_OPEN:
-		if !a.SessionHasPermissionToChannel(args.Session, channel.Id, model.PERMISSION_JOIN_PUBLIC_CHANNELS) {
+		if !a.HasPermissionToChannel(args.UserId, channel.Id, model.PERMISSION_JOIN_PUBLIC_CHANNELS) {
 			return &model.CommandResponse{Text: args.T("api.command_join.fail.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
 		}
 	case model.CHANNEL_PRIVATE:
-		if !a.SessionHasPermissionToChannel(args.Session, channel.Id, model.PERMISSION_READ_CHANNEL) {
+		if !a.HasPermissionToChannel(args.UserId, channel.Id, model.PERMISSION_READ_CHANNEL) {
 			return &model.CommandResponse{Text: args.T("api.command_join.fail.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
 		}
 	default:
diff --git a/app/command_join_test.go b/app/command_join_test.go
index 3dee394e03..16fece24e9 100644
--- a/app/command_join_test.go
+++ b/app/command_join_test.go
@@ -26,7 +26,6 @@ func TestJoinCommandNoChannel(t *testing.T) {
 		UserId:  th.BasicUser2.Id,
 		SiteURL: "http://test.url",
 		TeamId:  th.BasicTeam.Id,
-		Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}, "asdsad")
 
 	assert.Equal(t, "api.command_join.list.app_error", resp.Text)
@@ -54,7 +53,6 @@ func TestJoinCommandForExistingChannel(t *testing.T) {
 		UserId:  th.BasicUser2.Id,
 		SiteURL: "http://test.url",
 		TeamId:  th.BasicTeam.Id,
-		Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}, channel2.Name)
 
 	assert.Equal(t, "", resp.Text)
@@ -83,7 +81,6 @@ func TestJoinCommandWithTilde(t *testing.T) {
 		UserId:  th.BasicUser2.Id,
 		SiteURL: "http://test.url",
 		TeamId:  th.BasicTeam.Id,
-		Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}, "~"+channel2.Name)
 
 	assert.Equal(t, "", resp.Text)
@@ -104,13 +101,14 @@ func TestJoinCommandPermissions(t *testing.T) {
 
 	cmd := &JoinProvider{}
 
+	user3 := th.CreateUser()
+
 	// Try a public channel *without* permission.
 	args := &model.CommandArgs{
 		T:       i18n.IdentityTfunc(),
-		UserId:  th.BasicUser2.Id,
+		UserId:  user3.Id,
 		SiteURL: "http://test.url",
 		TeamId:  th.BasicTeam.Id,
-		Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
 	}
 
 	actual := cmd.DoCommand(th.App, args, "~"+channel2.Name).Text
@@ -122,7 +120,6 @@ func TestJoinCommandPermissions(t *testing.T) {
 		UserId:  th.BasicUser2.Id,
 		SiteURL: "http://test.url",
 		TeamId:  th.BasicTeam.Id,
-		Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = cmd.DoCommand(th.App, args, "~"+channel2.Name).Text
@@ -142,7 +139,6 @@ func TestJoinCommandPermissions(t *testing.T) {
 		UserId:  th.BasicUser2.Id,
 		SiteURL: "http://test.url",
 		TeamId:  th.BasicTeam.Id,
-		Session: model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = cmd.DoCommand(th.App, args, "~"+channel3.Name).Text
diff --git a/app/command_loadtest.go b/app/command_loadtest.go
index 36b19417bd..f343e399ea 100644
--- a/app/command_loadtest.go
+++ b/app/command_loadtest.go
@@ -207,7 +207,11 @@ func (me *LoadTestProvider) SetupCommand(a *App, args *model.CommandArgs, messag
 		}
 	}
 	client := model.NewAPIv4Client(args.SiteURL)
-	client.SetToken(args.Session.Token)
+	sessions, err := a.GetSessions(args.UserId)
+	if err != nil || len(sessions) == 0 {
+		return &model.CommandResponse{Text: "Failed to get sessions.", ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}, err
+	}
+	client.SetToken(sessions[0].Token)
 
 	if doTeams {
 		if err := a.CreateBasicUser(client); err != nil {
@@ -318,7 +322,11 @@ func (me *LoadTestProvider) ChannelsCommand(a *App, args *model.CommandArgs, mes
 	}
 
 	client := model.NewAPIv4Client(args.SiteURL)
-	client.SetToken(args.Session.Token)
+	sessions, err := a.GetSessions(args.UserId)
+	if err != nil || len(sessions) == 0 {
+		return &model.CommandResponse{Text: "Failed to get sessions.", ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}, err
+	}
+	client.SetToken(sessions[0].Token)
 	channelCreator := NewAutoChannelCreator(client, team)
 	channelCreator.Fuzzy = doFuzz
 	channelCreator.CreateTestChannels(channelsr)
@@ -339,12 +347,16 @@ func (me *LoadTestProvider) ThreadedPostCommand(a *App, args *model.CommandArgs,
 	}
 
 	client := model.NewAPIv4Client(args.SiteURL)
-	client.MockSession(args.Session.Token)
+	sessions, err := a.GetSessions(args.UserId)
+	if err != nil || len(sessions) == 0 {
+		return &model.CommandResponse{Text: "Failed to get sessions.", ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}, err
+	}
+	client.MockSession(sessions[0].Token)
 	testPoster := NewAutoPostCreator(client, args.ChannelId)
 	testPoster.Fuzzy = true
 	testPoster.Users = usernames
-	rpost, err := testPoster.CreateRandomPost()
-	if err != nil {
+	rpost, err2 := testPoster.CreateRandomPost()
+	if err2 != nil {
 		return &model.CommandResponse{Text: "Failed to create a post", ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}, err
 	}
 	for i := 0; i < 1000; i++ {
@@ -388,7 +400,11 @@ func (me *LoadTestProvider) PostsCommand(a *App, args *model.CommandArgs, messag
 	}
 
 	client := model.NewAPIv4Client(args.SiteURL)
-	client.SetToken(args.Session.Token)
+	sessions, err := a.GetSessions(args.UserId)
+	if err != nil || len(sessions) == 0 {
+		return &model.CommandResponse{Text: "Failed to get sessions.", ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}, err
+	}
+	client.SetToken(sessions[0].Token)
 	testPoster := NewAutoPostCreator(client, args.ChannelId)
 	testPoster.Fuzzy = doFuzz
 	testPoster.Users = usernames
diff --git a/app/command_logout.go b/app/command_logout.go
index e12de2f05a..c55a800ab5 100644
--- a/app/command_logout.go
+++ b/app/command_logout.go
@@ -34,15 +34,6 @@ func (me *LogoutProvider) GetCommand(a *App, T goi18n.TranslateFunc) *model.Comm
 }
 
 func (me *LogoutProvider) DoCommand(a *App, args *model.CommandArgs, message string) *model.CommandResponse {
-	FAIL := &model.CommandResponse{ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL, Text: args.T("api.command_logout.fail_message")}
-	SUCCESS := &model.CommandResponse{GotoLocation: "/login"}
-
-	// We can't actually remove the user's cookie from here so we just dump their session and let the browser figure it out
-	if args.Session.Id != "" {
-		if err := a.RevokeSessionById(args.Session.Id); err != nil {
-			return FAIL
-		}
-		return SUCCESS
-	}
-	return FAIL
+	// Actual logout is handled client side.
+	return &model.CommandResponse{GotoLocation: "/login"}
 }
diff --git a/app/command_msg.go b/app/command_msg.go
index 5ef2737fa7..2730dbca5d 100644
--- a/app/command_msg.go
+++ b/app/command_msg.go
@@ -76,7 +76,7 @@ func (me *msgProvider) DoCommand(a *App, args *model.CommandArgs, message string
 	if channel, channelErr := a.Srv().Store.Channel().GetByName(args.TeamId, channelName, true); channelErr != nil {
 		var nfErr *store.ErrNotFound
 		if errors.As(channelErr, &nfErr) {
-			if !a.SessionHasPermissionTo(args.Session, model.PERMISSION_CREATE_DIRECT_CHANNEL) {
+			if !a.HasPermissionTo(args.UserId, model.PERMISSION_CREATE_DIRECT_CHANNEL) {
 				return &model.CommandResponse{Text: args.T("api.command_msg.permission.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
 			}
 
@@ -105,15 +105,7 @@ func (me *msgProvider) DoCommand(a *App, args *model.CommandArgs, message string
 		}
 	}
 
-	teamId := args.TeamId
-	if teamId == "" {
-		if len(args.Session.TeamMembers) == 0 {
-			return &model.CommandResponse{Text: args.T("api.command_msg.fail.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
-		}
-		teamId = args.Session.TeamMembers[0].TeamId
-	}
-
-	team, err := a.GetTeam(teamId)
+	team, err := a.GetTeam(args.TeamId)
 	if err != nil {
 		return &model.CommandResponse{Text: args.T("api.command_msg.fail.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
 	}
diff --git a/app/command_msg_test.go b/app/command_msg_test.go
index 8673215261..7d0f92a539 100644
--- a/app/command_msg_test.go
+++ b/app/command_msg_test.go
@@ -20,30 +20,28 @@ func TestMsgProvider(t *testing.T) {
 	th.LinkUserToTeam(th.BasicUser, team)
 	cmd := &msgProvider{}
 
+	th.RemovePermissionFromRole(model.PERMISSION_CREATE_DIRECT_CHANNEL.Id, model.SYSTEM_USER_ROLE_ID)
+
 	// Check without permission to create a DM channel.
 	resp := cmd.DoCommand(th.App, &model.CommandArgs{
 		T:       i18n.IdentityTfunc(),
 		SiteURL: "http://test.url",
 		TeamId:  team.Id,
 		UserId:  th.BasicUser.Id,
-		Session: model.Session{
-			Roles: "",
-		},
 	}, "@"+th.BasicUser2.Username+" hello")
 
 	channelName := model.GetDMNameFromIds(th.BasicUser.Id, th.BasicUser2.Id)
 	assert.Equal(t, "api.command_msg.permission.app_error", resp.Text)
 	assert.Equal(t, "", resp.GotoLocation)
 
+	th.AddPermissionToRole(model.PERMISSION_CREATE_DIRECT_CHANNEL.Id, model.SYSTEM_USER_ROLE_ID)
+
 	// Check with permission to create a DM channel.
 	resp = cmd.DoCommand(th.App, &model.CommandArgs{
 		T:       i18n.IdentityTfunc(),
 		SiteURL: "http://test.url",
 		TeamId:  team.Id,
 		UserId:  th.BasicUser.Id,
-		Session: model.Session{
-			Roles: model.SYSTEM_USER_ROLE_ID,
-		},
 	}, "@"+th.BasicUser2.Username+" hello")
 
 	assert.Equal(t, "", resp.Text)
@@ -55,9 +53,6 @@ func TestMsgProvider(t *testing.T) {
 		SiteURL: "http://test.url",
 		TeamId:  team.Id,
 		UserId:  th.BasicUser.Id,
-		Session: model.Session{
-			Roles: "",
-		},
 	}, "@"+th.BasicUser2.Username+" hello")
 
 	assert.Equal(t, "", resp.Text)
@@ -76,9 +71,6 @@ func TestMsgProvider(t *testing.T) {
 		SiteURL: "http://test.url",
 		TeamId:  th.BasicTeam.Id,
 		UserId:  guest.Id,
-		Session: model.Session{
-			Roles: model.SYSTEM_GUEST_ROLE_ID,
-		},
 	}, "@"+user.Username+" hello")
 
 	assert.Equal(t, "api.command_msg.missing.app_error", resp.Text)
@@ -93,9 +85,6 @@ func TestMsgProvider(t *testing.T) {
 		SiteURL: "http://test.url",
 		TeamId:  th.BasicTeam.Id,
 		UserId:  guest.Id,
-		Session: model.Session{
-			Roles: model.SYSTEM_GUEST_ROLE_ID,
-		},
 	}, "@"+user.Username+" hello")
 
 	channelName = model.GetDMNameFromIds(guest.Id, user.Id)
diff --git a/app/command_remove.go b/app/command_remove.go
index 02f57891ce..656f5e1a18 100644
--- a/app/command_remove.go
+++ b/app/command_remove.go
@@ -75,14 +75,14 @@ func doCommand(a *App, args *model.CommandArgs, message string) *model.CommandRe
 
 	switch channel.Type {
 	case model.CHANNEL_OPEN:
-		if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS) {
+		if !a.HasPermissionToChannel(args.UserId, args.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS) {
 			return &model.CommandResponse{
 				Text:         args.T("api.command_remove.permission.app_error"),
 				ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL,
 			}
 		}
 	case model.CHANNEL_PRIVATE:
-		if !a.SessionHasPermissionToChannel(args.Session, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS) {
+		if !a.HasPermissionToChannel(args.UserId, args.ChannelId, model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS) {
 			return &model.CommandResponse{
 				Text:         args.T("api.command_remove.permission.app_error"),
 				ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL,
diff --git a/app/command_remove_test.go b/app/command_remove_test.go
index 2b33ba697f..d0b91b5ee9 100644
--- a/app/command_remove_test.go
+++ b/app/command_remove_test.go
@@ -42,7 +42,7 @@ func TestRemoveProviderDoCommand(t *testing.T) {
 	args := &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: publicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual := rp.DoCommand(th.App, args, targetUser.Username).Text
@@ -53,7 +53,7 @@ func TestRemoveProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: publicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, targetUser.Username).Text
@@ -63,7 +63,7 @@ func TestRemoveProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, targetUser.Username).Text
@@ -74,7 +74,7 @@ func TestRemoveProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, targetUser.Username).Text
@@ -89,7 +89,7 @@ func TestRemoveProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: groupChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, user1.Username).Text
@@ -101,7 +101,7 @@ func TestRemoveProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: directChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, user1.Username).Text
@@ -116,7 +116,7 @@ func TestRemoveProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: publicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		UserId:    th.BasicUser.Id,
 	}
 
 	actual = rp.DoCommand(th.App, args, deactivatedUser.Username).Text
diff --git a/i18n/en.json b/i18n/en.json
index 40440f1919..07204f54a6 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -910,10 +910,6 @@
     "id": "api.command_logout.desc",
     "translation": "Logout of Mattermost"
   },
-  {
-    "id": "api.command_logout.fail_message",
-    "translation": "Failed to log out"
-  },
   {
     "id": "api.command_logout.name",
     "translation": "logout"
diff --git a/model/command_args.go b/model/command_args.go
index a3bbb4c9d1..15a6372a1c 100644
--- a/model/command_args.go
+++ b/model/command_args.go
@@ -20,9 +20,11 @@ type CommandArgs struct {
 	Command         string               `json:"command"`
 	SiteURL         string               `json:"-"`
 	T               goi18n.TranslateFunc `json:"-"`
-	Session         Session              `json:"-"`
 	UserMentions    UserMentionMap       `json:"-"`
 	ChannelMentions ChannelMentionMap    `json:"-"`
+
+	// DO NOT USE Session field is deprecated. MM-26398
+	Session Session `json:"-"`
 }
 
 func (o *CommandArgs) ToJson() string {