diff --git a/ydb/core/driver_lib/cli_base/cli_cmds_root.cpp b/ydb/core/driver_lib/cli_base/cli_cmds_root.cpp
index dc7a92f11ddc..a42c7cb20a7d 100644
--- a/ydb/core/driver_lib/cli_base/cli_cmds_root.cpp
+++ b/ydb/core/driver_lib/cli_base/cli_cmds_root.cpp
@@ -66,6 +66,8 @@ void TClientCommandRootKikimrBase::Parse(TConfig& config) {
     ParseProfile();
     GetProfileVariable("path", config.Path);
     TClientCommandRootBase::Parse(config);
+    ParseCredentials(config);
+    ParseAddress(config);
     NClient::TKikimr::DUMP_REQUESTS = DumpRequests;
 }
 
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_admin.cpp b/ydb/public/lib/ydb_cli/commands/ydb_admin.cpp
index 14f263455ea3..c828bc21ee58 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_admin.cpp
+++ b/ydb/public/lib/ydb_cli/commands/ydb_admin.cpp
@@ -7,13 +7,33 @@
 namespace NYdb {
 namespace NConsoleClient {
 
+class TCommandNode : public TClientCommandTree {
+public:
+    TCommandNode()
+        : TClientCommandTree("node", {}, "Node-wide administration")
+    {}
+};
+
+class TCommandDatabase : public TClientCommandTree {
+public:
+    TCommandDatabase()
+        : TClientCommandTree("database", {}, "Database-wide administration")
+    {
+        AddCommand(std::make_unique<NDynamicConfig::TCommandConfig>());
+    }
+};
+
 TCommandAdmin::TCommandAdmin()
     : TClientCommandTree("admin", {}, "Administrative cluster operations")
 {
-    AddCommand(std::make_unique<NDynamicConfig::TCommandConfig>());
-    AddCommand(std::make_unique<NDynamicConfig::TCommandVolatileConfig>());
-    AddCommand(std::make_unique<NStorageConfig::TCommandStorageConfig>());
+    MarkDangerous();
+    UseOnlyExplicitProfile();
+    AddHiddenCommand(std::make_unique<NDynamicConfig::TCommandConfig>(false));
+    AddHiddenCommand(std::make_unique<NDynamicConfig::TCommandVolatileConfig>());
+    AddHiddenCommand(std::make_unique<NStorageConfig::TCommandStorageConfig>(false));
     AddCommand(std::make_unique<NCluster::TCommandCluster>());
+    AddCommand(std::make_unique<TCommandNode>());
+    AddCommand(std::make_unique<TCommandDatabase>());
 }
 
 }
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_cluster.cpp b/ydb/public/lib/ydb_cli/commands/ydb_cluster.cpp
index dfe1a7b302dc..dd99138ce458 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_cluster.cpp
+++ b/ydb/public/lib/ydb_cli/commands/ydb_cluster.cpp
@@ -1,5 +1,6 @@
 #include "ydb_cluster.h"
 
+#include "ydb_dynamic_config.h"
 #include <ydb/public/sdk/cpp/client/ydb_bsconfig/ydb_storage_config.h>
 
 using namespace NKikimr;
@@ -10,6 +11,7 @@ TCommandCluster::TCommandCluster()
     : TClientCommandTree("cluster", {}, "Cluster-wide administration")
 {
     AddCommand(std::make_unique<TCommandClusterBootstrap>());
+    AddCommand(std::make_unique<NDynamicConfig::TCommandConfig>());
 }
 
 TCommandClusterBootstrap::TCommandClusterBootstrap()
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_dynamic_config.cpp b/ydb/public/lib/ydb_cli/commands/ydb_dynamic_config.cpp
index 386a781fa737..03c9eaababa4 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_dynamic_config.cpp
+++ b/ydb/public/lib/ydb_cli/commands/ydb_dynamic_config.cpp
@@ -22,14 +22,28 @@ TString WrapYaml(const TString& yaml) {
     return out.Str();
 }
 
-TCommandConfig::TCommandConfig()
+TCommandConfig::TCommandConfig(std::optional<bool> overrideOnlyExplicitProfile)
     : TClientCommandTree("config", {}, "Dynamic config")
+    , OverrideOnlyExplicitProfile(overrideOnlyExplicitProfile)
 {
     AddCommand(std::make_unique<TCommandConfigFetch>());
     AddCommand(std::make_unique<TCommandConfigReplace>());
     AddCommand(std::make_unique<TCommandConfigResolve>());
 }
 
+
+void TCommandConfig::PropagateFlags(const TCommandFlags& flags) {
+    TClientCommand::PropagateFlags(flags);
+
+    if (OverrideOnlyExplicitProfile) {
+        OnlyExplicitProfile = *OverrideOnlyExplicitProfile;
+    }
+
+    for (auto& [_, cmd] : SubCommands) {
+        cmd->PropagateFlags(TCommandFlags{.Dangerous = Dangerous, .OnlyExplicitProfile = OnlyExplicitProfile});
+    }
+}
+
 TCommandConfigFetch::TCommandConfigFetch()
     : TYdbCommand("fetch", {"get", "dump"}, "Fetch main dynamic-config")
 {
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_dynamic_config.h b/ydb/public/lib/ydb_cli/commands/ydb_dynamic_config.h
index 3e43f846cbc6..d139943809b0 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_dynamic_config.h
+++ b/ydb/public/lib/ydb_cli/commands/ydb_dynamic_config.h
@@ -9,7 +9,10 @@ namespace NYdb::NConsoleClient::NDynamicConfig {
 
 class TCommandConfig : public TClientCommandTree {
 public:
-    TCommandConfig();
+    TCommandConfig(std::optional<bool> overrideOnlyExplicitProfile = std::nullopt);
+    void PropagateFlags(const TCommandFlags& flags) override;
+private:
+    std::optional<bool> OverrideOnlyExplicitProfile;
 };
 
 class TCommandConfigReplace : public TYdbCommand {
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_root_common.cpp b/ydb/public/lib/ydb_cli/commands/ydb_root_common.cpp
index 3041806714ae..4be1e3ff265a 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_root_common.cpp
+++ b/ydb/public/lib/ydb_cli/commands/ydb_root_common.cpp
@@ -36,7 +36,7 @@ TClientCommandRootCommon::TClientCommandRootCommon(const TString& name, const TC
     , Settings(settings)
 {
     ValidateSettings();
-    AddCommand(std::make_unique<TCommandAdmin>());
+    AddDangerousCommand(std::make_unique<TCommandAdmin>());
     AddCommand(std::make_unique<TCommandAuth>());
     AddCommand(std::make_unique<TCommandDiscovery>());
     AddCommand(std::make_unique<TCommandScheme>());
@@ -54,6 +54,7 @@ TClientCommandRootCommon::TClientCommandRootCommon(const TString& name, const TC
     AddCommand(std::make_unique<TCommandTopic>());
     AddCommand(std::make_unique<TCommandWorkload>());
     AddCommand(std::make_unique<TCommandDebug>());
+    PropagateFlags(TCommandFlags{.Dangerous = false, .OnlyExplicitProfile = false});
 }
 
 void TClientCommandRootCommon::ValidateSettings() {
@@ -328,6 +329,11 @@ void TClientCommandRootCommon::Config(TConfig& config) {
 }
 
 void TClientCommandRootCommon::Parse(TConfig& config) {
+    TClientCommandRootBase::Parse(config);
+    config.VerbosityLevel = std::min(static_cast<TConfig::EVerbosityLevel>(VerbosityLevel), TConfig::EVerbosityLevel::DEBUG);
+}
+
+void TClientCommandRootCommon::PostPrepare(TConfig& config) {
     if (ProfileFile.empty()) {
         config.ProfileFile = TStringBuilder() << HomeDir << '/' << Settings.YdbDir << "/config/config.yaml";
     } else {
@@ -339,12 +345,12 @@ void TClientCommandRootCommon::Parse(TConfig& config) {
     ProfileManager = CreateProfileManager(config.ProfileFile);
     ParseProfile();
 
-    TClientCommandRootBase::Parse(config);
     ParseDatabase(config);
     ParseCaCerts(config);
     ParseIamEndpoint(config);
 
-    config.VerbosityLevel = std::min(static_cast<TConfig::EVerbosityLevel>(VerbosityLevel), TConfig::EVerbosityLevel::DEBUG);
+    ParseCredentials(config);
+    ParseAddress(config);
 }
 
 namespace {
@@ -435,7 +441,7 @@ void TClientCommandRootCommon::ParseAddress(TConfig& config) {
         return;
     }
     // Priority 3. Active profile (if --profile option is not specified)
-    if (TryGetParamFromProfile("endpoint", ProfileManager->GetActiveProfile(), false, getAddress)) {
+    if (!config.OnlyExplicitProfile && TryGetParamFromProfile("endpoint", ProfileManager->GetActiveProfile(), false, getAddress)) {
         return;
     }
 }
@@ -519,7 +525,7 @@ void TClientCommandRootCommon::ParseDatabase(TConfig& config) {
         return;
     }
     // Priority 3. Active profile (if --profile option is not specified)
-    if (TryGetParamFromProfile("database", ProfileManager->GetActiveProfile(), false, getDatabase)) {
+    if (!config.OnlyExplicitProfile && TryGetParamFromProfile("database", ProfileManager->GetActiveProfile(), false, getDatabase)) {
         return;
     }
 }
@@ -574,11 +580,15 @@ void TClientCommandRootCommon::Validate(TConfig& config) {
             throw TMisuseException() << errors;
         }
     }
+
+    // TODO: Maybe NeedToConnect doesn't always mean that we don't need to check endpoint and database
+    // TODO: Now we supplying only one error while it is possible to return all errors at once,
+    //       maybe even erros from nested command's validate
     if (!config.NeedToConnect) {
         return;
     }
 
-    if (config.Address.empty()) {
+    if (config.Address.empty() && config.AllowEmptyAddress) {
         throw TMisuseException() << "Missing required option 'endpoint'.";
     }
 
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_root_common.h b/ydb/public/lib/ydb_cli/commands/ydb_root_common.h
index e87a587b2fb8..cfa571b41d04 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_root_common.h
+++ b/ydb/public/lib/ydb_cli/commands/ydb_root_common.h
@@ -31,6 +31,7 @@ class TClientCommandRootCommon : public TClientCommandRootBase {
 public:
     TClientCommandRootCommon(const TString& name, const TClientSettings& settings);
     void Config(TConfig& config) override;
+    void PostPrepare(TConfig& config) override;
     void Parse(TConfig& config) override;
     void ParseAddress(TConfig& config) override;
     void ParseCredentials(TConfig& config) override;
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_service_scheme.cpp b/ydb/public/lib/ydb_cli/commands/ydb_service_scheme.cpp
index 0f63d7da25c4..8d6c5bc57391 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_service_scheme.cpp
+++ b/ydb/public/lib/ydb_cli/commands/ydb_service_scheme.cpp
@@ -41,10 +41,10 @@ void TCommandMakeDirectory::Config(TConfig& config) {
 
 void TCommandMakeDirectory::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
 }
 
 int TCommandMakeDirectory::Run(TConfig& config) {
+    ParsePath(config, 0);
     NScheme::TSchemeClient client(CreateDriver(config));
     ThrowOnError(
         client.MakeDirectory(
@@ -76,10 +76,10 @@ void TCommandRemoveDirectory::Config(TConfig& config) {
 
 void TCommandRemoveDirectory::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
 }
 
 int TCommandRemoveDirectory::Run(TConfig& config) {
+    ParsePath(config, 0);
     TDriver driver = CreateDriver(config);
     NScheme::TSchemeClient schemeClient(driver);
     const auto settings = FillSettings(NScheme::TRemoveDirectorySettings());
@@ -243,10 +243,10 @@ void TCommandDescribe::Parse(TConfig& config) {
     TClientCommand::Parse(config);
     Database = config.Database;
     ParseOutputFormats();
-    ParsePath(config, 0);
 }
 
 int TCommandDescribe::Run(TConfig& config) {
+    ParsePath(config, 0);
     TDriver driver = CreateDriver(config);
     NScheme::TSchemeClient client(driver);
     NScheme::TDescribePathResult result = client.DescribePath(
@@ -1048,7 +1048,6 @@ void TCommandList::Config(TConfig& config) {
 
 void TCommandList::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0, true);
     if (AdvancedMode && FromNewLine) {
         // TODO: add "consider using --format shell"
         throw TMisuseException() << "Options -1 and -l are incompatible";
@@ -1056,6 +1055,7 @@ void TCommandList::Parse(TConfig& config) {
 }
 
 int TCommandList::Run(TConfig& config) {
+    ParsePath(config, 0, true);
     TDriver driver = CreateDriver(config);
     ISchemePrinter::TSettings settings = {
         Path,
@@ -1118,7 +1118,6 @@ void TCommandPermissionGrant::Config(TConfig& config) {
 
 void TCommandPermissionGrant::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
     Subject = config.ParseResult->GetFreeArgs()[1];
     if (!Subject) {
         throw TMisuseException() << "Missing required argument <subject>";
@@ -1129,6 +1128,7 @@ void TCommandPermissionGrant::Parse(TConfig& config) {
 }
 
 int TCommandPermissionGrant::Run(TConfig& config) {
+    ParsePath(config, 0);
     NScheme::TSchemeClient client(CreateDriver(config));
     ThrowOnError(
         client.ModifyPermissions(
@@ -1159,7 +1159,6 @@ void TCommandPermissionRevoke::Config(TConfig& config) {
 
 void TCommandPermissionRevoke::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
     Subject = config.ParseResult->GetFreeArgs()[1];
     if (!Subject) {
         throw TMisuseException() << "Missing required argument <subject>";
@@ -1170,6 +1169,7 @@ void TCommandPermissionRevoke::Parse(TConfig& config) {
 }
 
 int TCommandPermissionRevoke::Run(TConfig& config) {
+    ParsePath(config, 0);
     NScheme::TSchemeClient client(CreateDriver(config));
     ThrowOnError(
         client.ModifyPermissions(
@@ -1200,7 +1200,6 @@ void TCommandPermissionSet::Config(TConfig& config) {
 
 void TCommandPermissionSet::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
     Subject = config.ParseResult->GetFreeArgs()[1];
     if (!Subject) {
         throw TMisuseException() << "Missing required argument <subject>";
@@ -1211,6 +1210,7 @@ void TCommandPermissionSet::Parse(TConfig& config) {
 }
 
 int TCommandPermissionSet::Run(TConfig& config) {
+    ParsePath(config, 0);
     NScheme::TSchemeClient client(CreateDriver(config));
     ThrowOnError(
         client.ModifyPermissions(
@@ -1238,7 +1238,6 @@ void TCommandChangeOwner::Config(TConfig& config) {
 
 void TCommandChangeOwner::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
     Owner = config.ParseResult->GetFreeArgs()[1];
     if (!Owner){
         throw TMisuseException() << "Missing required argument <owner>";
@@ -1246,6 +1245,7 @@ void TCommandChangeOwner::Parse(TConfig& config) {
 }
 
 int TCommandChangeOwner::Run(TConfig& config) {
+    ParsePath(config, 0);
     NScheme::TSchemeClient client(CreateDriver(config));
     ThrowOnError(
         client.ModifyPermissions(
@@ -1272,10 +1272,10 @@ void TCommandPermissionClear::Config(TConfig& config) {
 
 void TCommandPermissionClear::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
 }
 
 int TCommandPermissionClear::Run(TConfig& config) {
+    ParsePath(config, 0);
     NScheme::TSchemeClient client(CreateDriver(config));
     ThrowOnError(
         client.ModifyPermissions(
@@ -1302,10 +1302,10 @@ void TCommandPermissionSetInheritance::Config(TConfig& config) {
 
 void TCommandPermissionSetInheritance::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
 }
 
 int TCommandPermissionSetInheritance::Run(TConfig& config) {
+    ParsePath(config, 0);
     NScheme::TSchemeClient client(CreateDriver(config));
     ThrowOnError(
         client.ModifyPermissions(
@@ -1332,10 +1332,10 @@ void TCommandPermissionClearInheritance::Config(TConfig& config) {
 
 void TCommandPermissionClearInheritance::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
 }
 
 int TCommandPermissionClearInheritance::Run(TConfig& config) {
+    ParsePath(config, 0);
     NScheme::TSchemeClient client(CreateDriver(config));
     ThrowOnError(
         client.ModifyPermissions(
@@ -1362,10 +1362,10 @@ void TCommandPermissionList::Config(TConfig& config) {
 
 void TCommandPermissionList::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    ParsePath(config, 0);
 }
 
 int TCommandPermissionList::Run(TConfig& config) {
+    ParsePath(config, 0);
     TDriver driver = CreateDriver(config);
     NScheme::TSchemeClient client(driver);
     NScheme::TDescribePathResult result = client.DescribePath(
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_storage_config.cpp b/ydb/public/lib/ydb_cli/commands/ydb_storage_config.cpp
index 1cf3cad99a8d..d9590964e108 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_storage_config.cpp
+++ b/ydb/public/lib/ydb_cli/commands/ydb_storage_config.cpp
@@ -22,13 +22,26 @@ TString WrapYaml(const TString& yaml) {
     return out.Str();
 }
 
-TCommandStorageConfig::TCommandStorageConfig()
+TCommandStorageConfig::TCommandStorageConfig(std::optional<bool> overrideOnlyExplicitProfile)
     : TClientCommandTree("storage", {}, "Storage config")
+    , OverrideOnlyExplicitProfile(overrideOnlyExplicitProfile)
 {
     AddCommand(std::make_unique<TCommandStorageConfigFetch>());
     AddCommand(std::make_unique<TCommandStorageConfigReplace>());
 }
 
+void TCommandStorageConfig::PropagateFlags(const TCommandFlags& flags) {
+    TClientCommand::PropagateFlags(flags);
+
+    if (OverrideOnlyExplicitProfile) {
+        OnlyExplicitProfile = *OverrideOnlyExplicitProfile;
+    }
+
+    for (auto& [_, cmd] : SubCommands) {
+        cmd->PropagateFlags(TCommandFlags{.Dangerous = Dangerous, .OnlyExplicitProfile = OnlyExplicitProfile});
+    }
+}
+
 TCommandStorageConfigFetch::TCommandStorageConfigFetch()
     : TYdbCommand("fetch", {}, "Fetch storage config")
 {
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_storage_config.h b/ydb/public/lib/ydb_cli/commands/ydb_storage_config.h
index a5c440a569ee..1092824e0e26 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_storage_config.h
+++ b/ydb/public/lib/ydb_cli/commands/ydb_storage_config.h
@@ -9,7 +9,10 @@ namespace NYdb::NConsoleClient::NStorageConfig {
 
 class TCommandStorageConfig : public TClientCommandTree {
 public:
-    TCommandStorageConfig();
+    TCommandStorageConfig(std::optional<bool> overrideOnlyExplicitProfile = std::nullopt);
+    void PropagateFlags(const TCommandFlags& flags) override;
+private:
+    std::optional<bool> OverrideOnlyExplicitProfile;
 };
 
 class TCommandStorageConfigReplace : public TYdbCommand {
diff --git a/ydb/public/lib/ydb_cli/commands/ydb_tools.cpp b/ydb/public/lib/ydb_cli/commands/ydb_tools.cpp
index ad148c53b5e7..0f8a1c736c74 100644
--- a/ydb/public/lib/ydb_cli/commands/ydb_tools.cpp
+++ b/ydb/public/lib/ydb_cli/commands/ydb_tools.cpp
@@ -86,10 +86,10 @@ void TCommandDump::Config(TConfig& config) {
 
 void TCommandDump::Parse(TConfig& config) {
     TClientCommand::Parse(config);
-    AdjustPath(config);
 }
 
 int TCommandDump::Run(TConfig& config) {
+    AdjustPath(config);
     NDump::TDumpSettings::EConsistencyLevel consistencyLevel;
     if (!TryFromString<NDump::TDumpSettings::EConsistencyLevel>(ConsistencyLevel, consistencyLevel)) {
         throw yexception() << "Incorrect consistency level."
diff --git a/ydb/public/lib/ydb_cli/common/command.cpp b/ydb/public/lib/ydb_cli/common/command.cpp
index c4f8dde9e5f5..12e5fb0a0362 100644
--- a/ydb/public/lib/ydb_cli/common/command.cpp
+++ b/ydb/public/lib/ydb_cli/common/command.cpp
@@ -208,6 +208,7 @@ void TClientCommand::CheckForExecutableOptions(TConfig& config) {
 
 void TClientCommand::Config(TConfig& config) {
     config.Opts = &Opts;
+    config.OnlyExplicitProfile = OnlyExplicitProfile;
     TStringStream stream;
     NColorizer::TColors colors = NColorizer::AutoColors(Cout);
     stream << Endl << Endl
@@ -251,9 +252,14 @@ void TClientCommand::Prepare(TConfig& config) {
     Parse(config);
 }
 
+void TClientCommand::PostPrepare(TConfig& config) {
+    Y_UNUSED(config);
+}
+
 int TClientCommand::ValidateAndRun(TConfig& config) {
     config.Opts = &Opts;
     config.ParseResult = ParseResult.get();
+    PostPrepare(config);
     Validate(config);
     return Run(config);
 }
@@ -316,7 +322,7 @@ void TClientCommand::RenderOneCommandDescription(
         prefix = "└─ ";
     }
     TString line = prefix + Name;
-    stream << prefix << colors.BoldColor() << Name << colors.OldColor();
+    stream << prefix << (Dangerous ? colors.Red() : "") << colors.BoldColor() << Name << colors.OldColor();
     if (!Description.empty()) {
         int namePartLength = GetNumberOfUTF8Chars(line);
         if (namePartLength < DESCRIPTION_ALIGNMENT)
@@ -339,6 +345,15 @@ void TClientCommand::RenderOneCommandDescription(
 
 void TClientCommand::Hide() {
     Hidden = true;
+    Visible = false;
+}
+
+void TClientCommand::MarkDangerous() {
+    Dangerous = true;
+}
+
+void TClientCommand::UseOnlyExplicitProfile() {
+    OnlyExplicitProfile = true;
 }
 
 TClientCommandTree::TClientCommandTree(const TString& name, const std::initializer_list<TString>& aliases, const TString& description)
@@ -361,6 +376,12 @@ void TClientCommandTree::AddHiddenCommand(std::unique_ptr<TClientCommand> comman
     AddCommand(std::move(command));
 }
 
+void TClientCommandTree::AddDangerousCommand(std::unique_ptr<TClientCommand> command) {
+    command->MarkDangerous();
+    command->UseOnlyExplicitProfile();
+    AddCommand(std::move(command));
+}
+
 void TClientCommandTree::Config(TConfig& config) {
     TClientCommand::Config(config);
     SetFreeArgs(config);
diff --git a/ydb/public/lib/ydb_cli/common/command.h b/ydb/public/lib/ydb_cli/common/command.h
index d9aadcf85dad..e38c6a39622c 100644
--- a/ydb/public/lib/ydb_cli/common/command.h
+++ b/ydb/public/lib/ydb_cli/common/command.h
@@ -17,6 +17,11 @@
 namespace NYdb {
 namespace NConsoleClient {
 
+struct TCommandFlags {
+    bool Dangerous = false;
+    bool OnlyExplicitProfile = false;
+};
+
 class TClientCommand {
 public:
     static bool TIME_REQUESTS; // measure time of requests
@@ -25,6 +30,9 @@ class TClientCommand {
     TVector<TString> Aliases;
     TString Description;
     bool Visible = true;
+    bool Hidden = false;
+    bool Dangerous = false;
+    bool OnlyExplicitProfile = false;
     const TClientCommand* Parent;
     NLastGetopt::TOpts Opts;
     TString Argument;
@@ -137,6 +145,8 @@ class TClientCommand {
         bool NeedToCheckForUpdate = true;
         bool ForceVersionCheck = false;
         bool AllowEmptyDatabase = false;
+        bool AllowEmptyAddress = false;
+        bool OnlyExplicitProfile = false;
 
         TCredentialsGetter CredentialsGetter;
 
@@ -307,7 +317,12 @@ class TClientCommand {
 
     virtual int Process(TConfig& config);
     virtual void Prepare(TConfig& config);
+    virtual void PostPrepare(TConfig& config);
     virtual int ValidateAndRun(TConfig& config);
+    virtual void PropagateFlags(const TCommandFlags& flags) {
+        Dangerous |= flags.Dangerous;
+        OnlyExplicitProfile |= flags.OnlyExplicitProfile;
+    }
 
     enum RenderEntryType {
         BEGIN,
@@ -322,6 +337,8 @@ class TClientCommand {
     );
 
     void Hide();
+    void MarkDangerous();
+    void UseOnlyExplicitProfile();
 
 protected:
     virtual void Config(TConfig& config);
@@ -342,7 +359,6 @@ class TClientCommand {
     void CheckForExecutableOptions(TConfig& config);
 
     constexpr static int DESCRIPTION_ALIGNMENT = 28;
-    bool Hidden = false;
 };
 
 class TClientCommandTree : public TClientCommand {
@@ -350,6 +366,7 @@ class TClientCommandTree : public TClientCommand {
     TClientCommandTree(const TString& name, const std::initializer_list<TString>& aliases = std::initializer_list<TString>(), const TString& description = TString());
     void AddCommand(std::unique_ptr<TClientCommand> command);
     void AddHiddenCommand(std::unique_ptr<TClientCommand> command);
+    void AddDangerousCommand(std::unique_ptr<TClientCommand> command);
     virtual void Prepare(TConfig& config) override;
     void RenderCommandsDescription(
         TStringStream& stream,
@@ -363,10 +380,15 @@ class TClientCommandTree : public TClientCommand {
     virtual void SaveParseResult(TConfig& config) override;
     virtual void Parse(TConfig& config) override;
     virtual int Run(TConfig& config) override;
+    virtual void PropagateFlags(const TCommandFlags& flags) override {
+        TClientCommand::PropagateFlags(flags);
+        for (auto& [_, cmd] : SubCommands) {
+            cmd->PropagateFlags(TCommandFlags{.Dangerous = Dangerous, .OnlyExplicitProfile = OnlyExplicitProfile});
+        }
+    }
 
     TClientCommand* SelectedCommand;
 
-private:
     bool HasOptionsToShow();
 
     TMap<TString, std::unique_ptr<TClientCommand>> SubCommands;
diff --git a/ydb/public/lib/ydb_cli/common/root.cpp b/ydb/public/lib/ydb_cli/common/root.cpp
index 98ab7bc1ccd9..3ebbbd2686e7 100644
--- a/ydb/public/lib/ydb_cli/common/root.cpp
+++ b/ydb/public/lib/ydb_cli/common/root.cpp
@@ -37,8 +37,6 @@ void TClientCommandRootBase::SetCustomUsage(TConfig& config) {
 
 void TClientCommandRootBase::Parse(TConfig& config) {
     TClientCommandTree::Parse(config);
-    ParseCredentials(config);
-    ParseAddress(config);
 
     TClientCommand::TIME_REQUESTS = TimeRequests;
     TClientCommand::PROGRESS_REQUESTS = ProgressRequests;