community 
More granular control for 'Admin Only' resources
Currently, an entire Family may be categorized as "Admin Only". This works well for some types of network devices that we want to make off limits. Other times, we need a more granular control. In a network test lab, using the same Shell for them, say Cisco IOSXR, we may have some units that are core backbone items that we need in the system and want to put under admin only; while others are part of the units for testing(DUT pool). Because they use the same shell, they are in the same family, and thus are excluded from the possibility of using the "admin only" functionality.
The other logical extension for this is with Apps. Especially with cybertraining exercises. We want to be able to deploy the training environment but only expose some of the VMs (now resources) to the 'Red Team' making the attack. Again, with the current Gen2 Shell design this is not possible to use the "Admin Only" functionality.
The ask is for a more granular ability control what resources are "admin only". This may include adding at the model level or at the individual resource level (by maybe a standard attribute).
