NETCONF operates over SSH, and so it assumes the permissions that apply to your SSH session. You can further control usage through TACACS+ auditing.

For information on the audit strings that are associated with each operation, see Supported NETCONF operations.