Create command rules

Updated: October 6, 2026

Want to summarize with AI?

Use this procedure to create command rules to permit or deny users in a user group from using certain commands.

Use this procedure to create command rules that control which commands users can read and execute.

Command rules are guidelines you can define for a user group to permit or deny access to specific commands. You can associate command rules with a user group and apply them to all users in that group.

You can create a command rule by specifying whether to permit or deny an operation on a command.

This table lists the possible operation and permission combinations.


Operation	Accept permission	Reject permission
Read (R)	Displays command on the CLI when you enter "?" from the CLI	Does not display command on the CLI when you enter "?" from the CLI
Execute (X)	Executes command from the CLI	Cannot execute command from the CLI
Read and execute (RX)	Displays command on the CLI and can execute command	Command is not visible or executable from the CLI

Permissions are set to reject by default.

Each command rule is identified by an associated number. When you apply multiple command rules to a user group, the command rule with a lower number takes precedence. For example, cmdrule5 permits read access, while cmdrule10 rejects read access. When both these command rules are applied to the same user group, users in this group get read access because cmdrule 5 takes precedence.

For example, you can create a command rule to deny read and execute permissions for the show platform command.

Before you begin

Create a user group. For details, see Create a user group.

Procedure

Enter the admin command to access System Admin EXEC mode.
Example:
```
RP/0/RP0/CPU0:ios# admin
```
Enter the config command to access System Admin config mode.
Example:
```
sysadmin-vm:0_RP0# config
```
Enter the aaa authorization cmdrules cmdrule command_rule_number command to create a command rule.
Example:
```
sysadmin-vm:0_RP0#(config)# aaa authorization cmdrules cmdrule 1100
```
This command specifies a numeric value as the command rule number. You can enter a 32-bit integer.

Do not use numbers 1–1000 because they are reserved by Cisco.

This command creates a new command rule if it does not already exist. It then enters the command rule configuration mode. In this example, command rule 1100 is created.

Note

By default, the system creates cmdrule 1 when the root-system user is created. This command rule provides accept permission to read and execute operations for all commands. Therefore, the root user has no restrictions that are imposed on it, unless cmdrule 1 is modified.
Enter the command command_name command to specify the command for which permission is controlled.
Example:
```
sysadmin-vm:0_RP0#(config-cmdrule-1100)# command "show platform"
```
Entering an asterisk (*) for the command applies the rule to all commands.
Enter the ops command to specify the operation for which permission must be set.
Example:
```
sysadmin-vm:0_RP0#(config-cmdrule-1100)# ops rx
```
- r: read
- x: execute
- rx: read and execute
Enter the action {accept | accept_log | reject} command to specify whether users are permitted or denied the use of the operation.
Example:
```
sysadmin-vm:0_RP0#(config-cmdrule-1100)# action reject
```
This command specifies whether users are permitted or denied the use of the operation:
- accept: Users are permitted to perform the operation.
- accept_log: Users are permitted to perform the operation and every access attempt is logged.
- reject: Users are restricted from performing the operation.
Enter the group user_group_name command to specify the user group to which the command rule applies.
Example:
```
sysadmin-vm:0_RP0#(config-cmdrule-1100)# group gr1
```
Enter the context connection_type command to specify the connection type to which this rule applies.
Example:
```
sysadmin-vm:0_RP0#(config-cmdrule-1100)# context *
```
The connection type can be netconf (Network Configuration Protocol), cli (Command Line Interface), or xml (Extensible Markup Language). Entering an asterisk (*) applies the command rule to all connection types.
Enter the commit or end command to save the configuration.
The commit command saves the configuration changes and remains within the configuration session.

The end command prompts you to take one of these actions:
- Yes: saves configuration changes and exits the configuration session.
- No: exits the configuration session without committing the configuration changes.
- Cancel: remains in the configuration session without committing the configuration changes.

What to do next

Create data rules. See Create data rules for details.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Create command rules

Before you begin

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

What to do next