Only when going into enable mode. The theory is that if you're allowed into enable mode then you're allowed to change the config also.
If you want some users to be able to some enable-mode commands, but not to be able to go into config mode specifically, you can give them an enable-level password that'll put them into say, level 7 (instead of the default level 15), and then move certain commands down to level 7, so they'll only be able to do them.
Something like the following:
enable secret
enable secret level 7
privilege exec level 7 clear line
This allows users in privilege level 7 to do "clear line..." commands but nothing else. You just give the users the level 7 enable password rather than the level 15 password. They type the following:
Router> enable 7
Password:
Router# sho priv
Current privilege level is 7
Router# clear line 2
[confirm]
[OK]
Router# config t
^
% Invalid input detected at '^' marker.
Router#
