Before You Configure Login Classes
Before you configure a login class:
Review the predefined login classes to determine whether you can use one of these classes rather than creating a new one.
Make sure you are familiar with how to use regular expressions to specify which commands and configuration statements to allow or deny.
Consider that you can issue one allow statement and one deny statement for operation mode commands, and one allow statement and one deny statement for configuration mode commands. Use regular expressions in a statement to specify more than one command in a statement.
See Access to Individual Commands and Configuration Statements (SRC CLI).