Restricting cli commands in enable mode

NETCONF
1

There are cli commands existing in both enable and configure mode. Actually, there should be minimum commands available outside of config mode. So, changes are needed to restrict commands in enable mode. For backward compatibility, tailf:cli-configure-mode can’t be used. I tried adding cmdrule. It is like:
tag cmdrule xmlns=“http://tail-f.com/yang/acm”
tag name enable_clock_year_rule
tag context cli
tag command clock year
tag access-operations exec
tag action deny
tag end cmdrule

This change effected both enable and configure mode. I was not able to set clock year in both enable and configure mode.
Is there any way to hide the commands in cli in enable mode? Any suggestions? Thanks.

2

For built-in or automatically generated commands, you can use <hide src="..."/> in your clispec. But there are not many built-in commands shared between the enable mode and the config mode, so I’m assuming the commands you would like to disable are custom commands - in that case just remove them from the <operationalMode> section of your clispec file.