diff --git a/cli/documentation/en_US/aaa/aaa-accounting b/cli/documentation/en_US/aaa/aaa-accounting
new file mode 100755
index 0000000..61706fa
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-accounting
@@ -0,0 +1,3 @@
+Configure accounting (logging for user CLI events).
+Accounting is configured for a specific role, via a specific channel,
+for specific events, using one or more accounting services.
diff --git a/cli/documentation/en_US/aaa/aaa-accounting-example b/cli/documentation/en_US/aaa/aaa-accounting-example
new file mode 100755
index 0000000..85b0720
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-accounting-example
@@ -0,0 +1,13 @@
+aaa accounting exec default none
+  Turn off accounting services for SSH CLI accesses.
+  The native (/var/log) accounting cannot be disabled.
+
+no aaa accounting exec default
+  Reset the accounting services for SSH CLI accesses to defaults.
+  This disables all accounting services, with the exception
+  of native (/var/log) accounting, which is always enabled.
+
+aaa accounting exec default start-stop group tacacs+
+  Configure the currently-defined set of TACACS+ servers
+  as an accounting service for SSH CLI login and logout.
+
diff --git a/cli/documentation/en_US/aaa/aaa-accounting-exec b/cli/documentation/en_US/aaa/aaa-accounting-exec
new file mode 100755
index 0000000..7909537
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-accounting-exec
@@ -0,0 +1 @@
+Configure accounting services for exec mode (CLI access).
diff --git a/cli/documentation/en_US/aaa/aaa-accounting-exec-use-default b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-default
new file mode 100755
index 0000000..f536ed7
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-default
@@ -0,0 +1,5 @@
+Configure accounting services while connecting via the default channel
+(currently SSH).
+
+Reset the accounting services (currently to native /var/log logging)
+with the 'no' version of this command.
diff --git a/cli/documentation/en_US/aaa/aaa-accounting-exec-use-none b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-none
new file mode 100755
index 0000000..7620c19
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-none
@@ -0,0 +1,3 @@
+Disable accounting services for this role and channel.
+
+Note that local (/var/log) accounting is always enabled.
diff --git a/cli/documentation/en_US/aaa/aaa-accounting-exec-use-server-group b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-server-group
new file mode 100755
index 0000000..2b0ce79
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-server-group
@@ -0,0 +1,2 @@
+Configure accounting services to use a specific group of accounting
+servers.
diff --git a/cli/documentation/en_US/aaa/aaa-accounting-exec-use-start-stop b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-start-stop
new file mode 100755
index 0000000..f3842ed
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-start-stop
@@ -0,0 +1,2 @@
+Configure accounting services to record 'start' (login)
+and 'stop' (logout) events.
diff --git a/cli/documentation/en_US/aaa/aaa-accounting-exec-use-tacacs b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-tacacs
new file mode 100755
index 0000000..342e567
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-accounting-exec-use-tacacs
@@ -0,0 +1,2 @@
+Configure the currently-defined TACACS+ servers (the 'tacacs+' group)
+as an accounting service.
diff --git a/cli/documentation/en_US/aaa/aaa-authentication b/cli/documentation/en_US/aaa/aaa-authentication
new file mode 100755
index 0000000..6df1b62
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authentication
@@ -0,0 +1,3 @@
+Configure authentication (user password validation).  Users are
+authenticated for a specific task and via a specific channel, using one
+or more authentication sources.
diff --git a/cli/documentation/en_US/aaa/aaa-authentication-example b/cli/documentation/en_US/aaa/aaa-authentication-example
new file mode 100755
index 0000000..edca25d
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authentication-example
@@ -0,0 +1,14 @@
+aaa authentication login default group tacacs+
+  Use TACACS+ for authenticating SSH CLI logins
+
+aaa authentication login default local
+  Use local UNIX /etc/passwd for authenticating SSH CLI logins.
+
+aaa authentication login default group tacacs+ local
+  Use both TACACS+ and /etc/passwd for login.
+
+no aaa authentication login default
+  Reset authentication sources for SSH CLI login.
+
+
+
diff --git a/cli/documentation/en_US/aaa/aaa-authentication-login b/cli/documentation/en_US/aaa/aaa-authentication-login
new file mode 100755
index 0000000..47d6bcf
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authentication-login
@@ -0,0 +1 @@
+Configure authentication sources for CLI login.
diff --git a/cli/documentation/en_US/aaa/aaa-authentication-login-use-default b/cli/documentation/en_US/aaa/aaa-authentication-login-use-default
new file mode 100755
index 0000000..824546a
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authentication-login-use-default
@@ -0,0 +1,5 @@
+Configure authentication sources while logging into the CLI
+via the default channel (currently SSH).
+
+Reset the authentication sources (currently to 'local' only) with
+the 'no' version of this command.
diff --git a/cli/documentation/en_US/aaa/aaa-authentication-login-use-local b/cli/documentation/en_US/aaa/aaa-authentication-login-use-local
new file mode 100755
index 0000000..43111ca
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authentication-login-use-local
@@ -0,0 +1,2 @@
+Configure the local password database (UNIX /etc/passwd)
+as an authentication mechanism.
diff --git a/cli/documentation/en_US/aaa/aaa-authentication-login-use-tacacs b/cli/documentation/en_US/aaa/aaa-authentication-login-use-tacacs
new file mode 100755
index 0000000..6e7e2bc
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authentication-login-use-tacacs
@@ -0,0 +1,2 @@
+Use the set of all defined TACACS+ servers (the 'tacacs+' group)
+as an authentication source.
diff --git a/cli/documentation/en_US/aaa/aaa-authorization b/cli/documentation/en_US/aaa/aaa-authorization
new file mode 100755
index 0000000..ea4decc
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authorization
@@ -0,0 +1,2 @@
+Configure authorization (user privileges).  Users are authorized for a specific role
+and via a specific channel, using one or more authorization sources.
diff --git a/cli/documentation/en_US/aaa/aaa-authorization-example b/cli/documentation/en_US/aaa/aaa-authorization-example
new file mode 100755
index 0000000..64dfedd
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authorization-example
@@ -0,0 +1,14 @@
+aaa authorization exec default group tacacs+
+  Use TACACS+ for authorizing CLI access
+
+aaa authorization exec default local
+  Use local UNIX /etc/passwd for authorizing CLI access
+
+aaa authorization exec default group tacacs+ local
+  Use both TACACS+ and /etc/passwd for CLI authorization
+
+no aaa authorization exec default
+  Reset authorization sources for SSH CLI access.
+
+
+
diff --git a/cli/documentation/en_US/aaa/aaa-authorization-exec b/cli/documentation/en_US/aaa/aaa-authorization-exec
new file mode 100755
index 0000000..dd5835b
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authorization-exec
@@ -0,0 +1 @@
+Configure authorization sources for exec mode (CLI access).
diff --git a/cli/documentation/en_US/aaa/aaa-authorization-exec-use-default b/cli/documentation/en_US/aaa/aaa-authorization-exec-use-default
new file mode 100755
index 0000000..9a39051
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authorization-exec-use-default
@@ -0,0 +1,5 @@
+Configure authorization sources while connecting via the default channel
+(currently SSH).
+
+Reset the authorization sources (currently to 'local' only) with
+the 'no' version of this command.
diff --git a/cli/documentation/en_US/aaa/aaa-authorization-exec-use-local b/cli/documentation/en_US/aaa/aaa-authorization-exec-use-local
new file mode 100755
index 0000000..9540a14
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authorization-exec-use-local
@@ -0,0 +1,2 @@
+Configure the local password database (UNIX /etc/passwd)
+as an authorization mechanism.
diff --git a/cli/documentation/en_US/aaa/aaa-authorization-exec-use-tacacs b/cli/documentation/en_US/aaa/aaa-authorization-exec-use-tacacs
new file mode 100755
index 0000000..bbddc6c
--- /dev/null
+++ b/cli/documentation/en_US/aaa/aaa-authorization-exec-use-tacacs
@@ -0,0 +1,2 @@
+Use the set of all defined TACACS+ servers (the 'tacacs+' group)
+as an authorization source.