When OpenConfig is enabled, the entire YANG tree is exposed to the client. This allows a client to have read and write access to all parts of the YANG tree. In some cases, it would be preferable to block portions of the YANG tree so that specific part of the tree cannot be modified or read by the client. 

The candidate configuration feature implements support for a candidate data store as specified in RFC6241.