> # Rules and Features for Each Role

> Up to 16 rules can be configured for each role. These rules reflect what CLI commands are allowed. The user-specified rule number determines the order in which the rules are applied. For example, rule 1 is applied before rule 2, which is applied before rule 3, and so on. A user not belonging to the network-admin role cannot perform commands related to roles.

> For example, if user A is permitted to perform all show CLI commands, user A cannot view the output of the show role CLI command if user A does not belong to the network-admin role.

> A rule specifies operations that can be performed by a specific role. Each rule consists of a rule number, a rule type (permit or deny), a CLI command type (for example, config, clear, show, exec, debug), and an optional feature name (for example, FSPF, zone, VSAN, fcping, or interface).

> Note In this case, exec CLI commands refer to all commands in the EXEC mode that are not included in the show, debug, and clear CLI command categories.

> Copyright 2010-2015, Cisco Systems, Inc. All rights reserved.