Hi
there are many ways to achieve this, but the *correct* and most scalable is to enable command authorisation on your devices.
In ACS create some groups based on the permissions levels each group should have.
In the groups enable the shell (exec) service.
At this point you can either list the denied commands for certains groups right in the group edit page itself.
Alternatively, you can created Device Command Sets in the share profiles UI. These are more flexible because inside a single group you cap map to different DCSs based on the device being managed (either by device ip or by network device group)
Its all there in the ACS docs!
Good luck.
