# Nacm rule to restrict db deletion

**URL:** <https://dmap-community.ductus.global/t/nacm-rule-to-restrict-db-deletion/4960>\
**Category:** NETCONF\
**Created:** [June 30, 2025, 2:45pm UTC](https://dmap-community.ductus.global/t/nacm-rule-to-restrict-db-deletion/4960 "2025-06-30T14:45:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vinuta\_mb](https://avatars.discourse-cdn.com/v4/letter/v/c57346/32.png) [@vinuta\_mb](https://dmap-community.ductus.global/u/vinuta_mb)\
**Post date:** [June 30, 2025, 2:45pm UTC](https://dmap-community.ductus.global/t/nacm-rule-to-restrict-db-deletion/4960/1 "2025-06-30T14:45:25Z")

</div>

Hi Team,

We are having one CLI in confd configuration mode for removing the database configuration. is there any way to create nacm rule to restrict only the execution of “no database” command in config mode.

**admin@orchestrator[TEST-Binding-master]# config**  
**Entering configuration mode terminal**  
**admin@orchestratorTEST-Binding-master# no database**  
**admin@orchestratorTEST-Binding-master#**

Thanks,  
Vinuta MB

---

<div class="post-metadata">

**Author:** ![vinuta\_mb](https://avatars.discourse-cdn.com/v4/letter/v/c57346/32.png) [@vinuta\_mb](https://dmap-community.ductus.global/u/vinuta_mb)\
**Post date:** [June 30, 2025, 3:06pm UTC](https://dmap-community.ductus.global/t/nacm-rule-to-restrict-db-deletion/4960/2 "2025-06-30T15:06:51Z")

</div>

rule data-base-access  
module-name tailf-cps-orchestrator  
path /database/  
access-operations read  
action permit  
!  
rule data-base-restrict  
module-name tailf-cps-orchestrator  
path /database/  
access-operations delete  
action deny  
!

tried with these rules but, they are restricting to view committed changes under database module also.

---

<div class="post-metadata">

**Author:** ![metakidu](https://avatars.discourse-cdn.com/v4/letter/m/8dc957/32.png) [@metakidu](https://dmap-community.ductus.global/u/metakidu)\
**Post date:** [July 1, 2025, 7:57pm UTC](https://dmap-community.ductus.global/t/nacm-rule-to-restrict-db-deletion/4960/3 "2025-07-01T19:57:12Z")

</div>

Hi Vinuta,

(Off-topic hint: I’d suggest to not create CLI related topics in the “NETCONF” section of the Forum)

What Daemon version are you using?  
How does your data module look like?  
Can you find any related log entry in the developer log with /confdConfig/logs/developerLogLevel set to “trace”?

Looking at your rules I’m wondering how trailing slash characters are handled by the ConfD NACM rule processing.  
Have you tried to use path value “/database” in the rules? (without the trailing slash)