diff --git a/command/ca/policy/x509/allow.go b/command/ca/policy/x509/allow.go
index d0e1c9651..6b10d0d28 100644
--- a/command/ca/policy/x509/allow.go
+++ b/command/ca/policy/x509/allow.go
@@ -15,8 +15,8 @@ func allowCommand(ctx context.Context) cli.Command {
 	return cli.Command{
 		Name:        "allow",
 		Usage:       "manage allowed names for X.509 certificate issuance policies",
-		UsageText:   "**step ca policy x509 allow** <subcommand> [arguments] [global-flags] [subcommand-flags]",
-		Description: `**step ca policy x509 allow** command group provides facilities for managing X.509 names to be allowed.`,
+		UsageText:   "**step ca policy <scope> x509 allow** <subcommand> [arguments] [global-flags] [subcommand-flags]",
+		Description: `**step ca policy <scope> x509 allow** command group provides facilities for managing X.509 names to be allowed.`,
 		Subcommands: cli.Commands{
 			actions.CommonNamesCommand(ctx),
 			actions.DNSCommand(ctx),
diff --git a/command/ca/policy/x509/deny.go b/command/ca/policy/x509/deny.go
index d4190a107..b6742a2d2 100644
--- a/command/ca/policy/x509/deny.go
+++ b/command/ca/policy/x509/deny.go
@@ -15,8 +15,8 @@ func denyCommand(ctx context.Context) cli.Command {
 	return cli.Command{
 		Name:        "deny",
 		Usage:       "manage denied names for X.509 certificate issuance policies",
-		UsageText:   "**step ca policy x509 deny** <subcommand> [arguments] [global-flags] [subcommand-flags]",
-		Description: `**step ca policy x509 deny** command group provides facilities for managing X.509 names to be denied.`,
+		UsageText:   "**step ca policy <scope> x509 deny** <subcommand> [arguments] [global-flags] [subcommand-flags]",
+		Description: `**step ca policy <scope> x509 deny** command group provides facilities for managing X.509 names to be denied.`,
 		Subcommands: cli.Commands{
 			actions.CommonNamesCommand(ctx),
 			actions.DNSCommand(ctx),
diff --git a/command/ca/policy/x509/wildcards.go b/command/ca/policy/x509/wildcards.go
index c52ca6bdf..108d4945c 100644
--- a/command/ca/policy/x509/wildcards.go
+++ b/command/ca/policy/x509/wildcards.go
@@ -18,8 +18,8 @@ func wildcardsCommand(ctx context.Context) cli.Command {
 	return cli.Command{
 		Name:        "wildcards",
 		Usage:       "manage wildcard name settings for X.509 certificate issuance policies",
-		UsageText:   `**step ca policy x509 wildcards**`,
-		Description: `**step ca policy x509 wildcards** command group provides facilities for managing X.509 wildcard names.`,
+		UsageText:   `**step ca policy <scope> x509 wildcards**`,
+		Description: `**step ca policy <scope> x509 wildcards** command group provides facilities for managing X.509 wildcard names.`,
 		Subcommands: cli.Commands{
 			allowWildcardsCommand(ctx),
 			denyWildcardsCommand(ctx),
@@ -31,12 +31,12 @@ func allowWildcardsCommand(ctx context.Context) cli.Command {
 	return cli.Command{
 		Name:  "allow",
 		Usage: "allow wildcard names in X.509 certificate issuance policies",
-		UsageText: `**step ca policy x509 wildcards allow**
+		UsageText: `**step ca policy <scope> x509 wildcards allow**
 [**--provisioner**=<name>] [**--eab-key-id**=<eab-key-id>] [**--eab-key-reference**=<eab-key-reference>]
 [**--admin-cert**=<file>] [**--admin-key**=<file>] [**--admin-subject**=<subject>]
 [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
 [**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>]`,
-		Description: `**step ca policy x509 wildcards allow** allow wildcard names in X.509 policy
+		Description: `**step ca policy <scope> x509 wildcards allow** allow wildcard names in X.509 policy
 
 ## EXAMPLES	
 
@@ -78,12 +78,12 @@ func denyWildcardsCommand(ctx context.Context) cli.Command {
 	return cli.Command{
 		Name:  "deny",
 		Usage: "deny wildcard names in X.509 certificate issuance policies",
-		UsageText: `**step ca policy x509 wildcards deny**
+		UsageText: `**step ca policy <scope> x509 wildcards deny**
 [**--provisioner**=<name>] [**--eab-key-id**=<eab-key-id>] [**--eab-key-reference**=<eab-key-reference>]
 [**--admin-cert**=<file>] [**--admin-key**=<file>] [**--admin-subject**=<subject>]
 [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
 [**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>]`,
-		Description: `**step ca policy x509 wildcards deny** deny wildcard names in X.509 policy
+		Description: `**step ca policy <scope> x509 wildcards deny** deny wildcard names in X.509 policy
 
 ## EXAMPLES	
 
diff --git a/command/ca/policy/x509/x509.go b/command/ca/policy/x509/x509.go
index 2dbafc9b3..0bb0dbb30 100644
--- a/command/ca/policy/x509/x509.go
+++ b/command/ca/policy/x509/x509.go
@@ -14,8 +14,8 @@ func Command(ctx context.Context) cli.Command {
 	return cli.Command{
 		Name:        "x509",
 		Usage:       "manage X.509 certificate issuance policies",
-		UsageText:   `**step ca policy x509** <subcommand> [arguments] [global-flags] [subcommand-flags]`,
-		Description: `**step ca policy x509** command group provides facilities for managing X.509 certificate issuance policies.`,
+		UsageText:   `**step ca policy <scope> x509** <subcommand> [arguments] [global-flags] [subcommand-flags]`,
+		Description: `**step ca policy <scope> x509** command group provides facilities for managing X.509 certificate issuance policies.`,
 		Subcommands: cli.Commands{
 			allowCommand(ctx),
 			denyCommand(ctx),