diff --git a/src/confd/share/factory.d/10-nacm.json b/src/confd/share/factory.d/10-nacm.json
index 49583a20..017c78cb 100644
--- a/src/confd/share/factory.d/10-nacm.json
+++ b/src/confd/share/factory.d/10-nacm.json
@@ -1,6 +1,9 @@
 {
     "ietf-netconf-acm:nacm": {
 	"enable-nacm": true,
+	"read-default": "permit",
+	"write-default": "permit",
+	"exec-default": "permit",
 	"groups": {
 	    "group": [
 		{
@@ -8,6 +11,14 @@
 		    "user-name": [
 			"admin"
 		    ]
+		},
+		{
+		    "name": "operator",
+		    "user-name": []
+		},
+		{
+		    "name": "guest",
+		    "user-name": []
 		}
 	    ]
 	},
@@ -27,16 +38,61 @@
 		    }
 		]
 	    },
+	    {
+		"name": "operator-acl",
+		"group": [
+		    "operator"
+		],
+		"rule": [
+		    {
+			"name": "permit-system-rpcs",
+			"module-name": "ietf-system",
+			"rpc-name": "*",
+			"access-operations": "exec",
+			"action": "permit",
+			"comment": "Operators can reboot, shutdown, and set system time."
+		    }
+		]
+	    },
+	    {
+		"name": "guest-acl",
+		"group": [
+		    "guest"
+		],
+		"rule": [
+		    {
+			"name": "deny-all-write+exec",
+			"module-name": "*",
+			"access-operations": "create update delete exec",
+			"action": "deny",
+			"comment": "Guests cannot change anything or exec rpcs."
+		    }
+		]
+	    },
 	    {
 		"name": "default-deny-all",
 		"group": ["*"],
 		"rule": [
 		    {
-			"name":  "deny-password-read",
-			"module-name": "ietf-system",
+			"name": "deny-password-access",
 			"path": "/ietf-system:system/authentication/user/password",
 			"access-operations": "*",
-			"action": "deny"
+			"action": "deny",
+			"comment": "No user except admins can access password hashes."
+		    },
+		    {
+			"name": "deny-keystore-access",
+			"module-name": "ietf-keystore",
+			"access-operations": "*",
+			"action": "deny",
+			"comment": "No user except admins can access cryptographic keys."
+		    },
+		    {
+			"name": "deny-truststore-access",
+			"module-name": "ietf-truststore",
+			"access-operations": "*",
+			"action": "deny",
+			"comment": "No user except admins can access trust store."
 		    }
 		]
 	    }
diff --git a/src/confd/share/factory.d/Makefile.am b/src/confd/share/factory.d/Makefile.am
index bc9a9b8f..72b40304 100644
--- a/src/confd/share/factory.d/Makefile.am
+++ b/src/confd/share/factory.d/Makefile.am
@@ -1,3 +1,3 @@
 factorydir          	= $(pkgdatadir)/factory.d
 dist_factory_DATA   	= 10-nacm.json 10-netconf-server.json \
-		      	10-infix-services.json 10-system.json
+			  10-infix-services.json 10-system.json