diff --git a/board/aarch32/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg b/board/aarch32/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg
index fcc963b9..a38b08c4 100644
--- a/board/aarch32/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg
+++ b/board/aarch32/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg
@@ -88,6 +88,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -95,6 +98,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -114,6 +125,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -121,11 +163,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
diff --git a/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg b/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg
index 255e094e..672a768a 100644
--- a/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg
+++ b/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg
@@ -226,6 +226,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -233,6 +236,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -252,6 +263,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -259,11 +301,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
diff --git a/board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg b/board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg
index a76a2291..b99a3410 100644
--- a/board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg
+++ b/board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg
@@ -126,6 +126,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -133,6 +136,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -152,6 +163,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -159,11 +201,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }
diff --git a/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg b/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg
index 3ad9aea0..bcacd51a 100644
--- a/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg
+++ b/board/aarch64/raspberrypi-rpi64/rootfs/usr/share/product/raspberrypi,4-model-b/etc/factory-config.cfg
@@ -103,6 +103,9 @@
   },
   "ietf-netconf-acm:nacm": {
     "enable-nacm": true,
+    "read-default": "permit",
+    "write-default": "permit",
+    "exec-default": "permit",
     "groups": {
       "group": [
         {
@@ -110,6 +113,14 @@
           "user-name": [
             "admin"
           ]
+        },
+        {
+          "name": "operator",
+          "user-name": []
+        },
+        {
+          "name": "guest",
+          "user-name": []
         }
       ]
     },
@@ -129,6 +140,37 @@
           }
         ]
       },
+      {
+        "name": "operator-acl",
+        "group": [
+          "operator"
+        ],
+        "rule": [
+          {
+            "name": "permit-system-rpcs",
+            "module-name": "ietf-system",
+            "rpc-name": "*",
+            "access-operations": "exec",
+            "action": "permit",
+            "comment": "Operators can reboot, shutdown, and set system time."
+          }
+        ]
+      },
+      {
+        "name": "guest-acl",
+        "group": [
+          "guest"
+        ],
+        "rule": [
+          {
+            "name": "deny-all-write+exec",
+            "module-name": "*",
+            "access-operations": "create update delete exec",
+            "action": "deny",
+            "comment": "Guests cannot change anything or exec rpcs."
+          }
+        ]
+      },
       {
         "name": "default-deny-all",
         "group": [
@@ -136,11 +178,25 @@
         ],
         "rule": [
           {
-            "name": "deny-password-read",
-            "module-name": "ietf-system",
+            "name": "deny-password-access",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
-            "action": "deny"
+            "action": "deny",
+            "comment": "No user except admins can access password hashes."
+          },
+          {
+            "name": "deny-keystore-access",
+            "module-name": "ietf-keystore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access cryptographic keys."
+          },
+          {
+            "name": "deny-truststore-access",
+            "module-name": "ietf-truststore",
+            "access-operations": "*",
+            "action": "deny",
+            "comment": "No user except admins can access trust store."
           }
         ]
       }