Another thing to add to this, the command itself is not part of the tab complete event.
This event doesn’t fire until the player has finished writing the command out (ex: /fly) and then they hit space… at that point the event fires and things can then be changed and/or cancelled.
I have seen a few posts now regarding tab complete events, and it seems quite common that people are misinterpreting which part of the event is actually handled by the tab complete event.
As electronic boy stated, its handled client side.
All the commands that are available as per permissions for said player, will be sent to the player (client) and is all handled client side. That being said (in spigot.yml):
if you set namespaces to false it won’t send commands with a colon, such as “bukkit:command”