diff --git a/common/console.c b/common/console.c
index e64d07f8d7..3b5524b996 100644
--- a/common/console.c
+++ b/common/console.c
@@ -676,7 +676,7 @@ void console_task(void)
 static int command_help(int argc, char **argv)
 {
 	const int ncmds = __cmds_end - __cmds;
-	const int cols = 5;  /* printing in five columns */
+	const int cols = 5;			/* printing in five columns */
 	const int rows = (ncmds + cols - 1) / cols;
 	int i, j;
 
@@ -685,12 +685,22 @@ static int command_help(int argc, char **argv)
 		const struct console_command *cmd;
 
 		if (!strcasecmp(argv[1], "list")) {
+#ifdef CONFIG_CONSOLE_COMMAND_FLAGS
+			ccputs("Command     Flags   Description\n");
+			for (i = 0; i < ncmds; i++) {
+				ccprintf(" %-14s %x %s\n",
+					 __cmds[i].name, __cmds[i].flags,
+					 __cmds[i].help);
+				cflush();
+			}
+#else
 			ccputs("Known commands:\n");
 			for (i = 0; i < ncmds; i++) {
 				ccprintf("  %-15s%s\n",
-					 __cmds[i].name, __cmds[i].shorthelp);
+					 __cmds[i].name, __cmds[i].help);
 				cflush();
 			}
+#endif
 			ccputs("HELP CMD = help on CMD.\n");
 			return EC_SUCCESS;
 		}
@@ -702,8 +712,8 @@ static int command_help(int argc, char **argv)
 		}
 		ccprintf("Usage: %s %s\n", cmd->name,
 			 (cmd->argdesc ? cmd->argdesc : ""));
-		if (cmd->shorthelp)
-			ccprintf("%s\n", cmd->shorthelp);
+		if (cmd->help)
+			ccprintf("%s\n", cmd->help);
 		return EC_SUCCESS;
 	}
 #endif
diff --git a/include/config.h b/include/config.h
index e28f5cf30e..0228dd439b 100644
--- a/include/config.h
+++ b/include/config.h
@@ -658,6 +658,22 @@
  */
 #define CONFIG_CONSOLE_CMDHELP
 
+/*
+ * Add a .flags field to the console commands data structure, to distinguish
+ * some commands from others. The available flags bits are defined in
+ * include/console.h
+ */
+#undef CONFIG_CONSOLE_COMMAND_FLAGS
+
+/*
+ * One use of the .flags field is to make some console commands restricted, so
+ * that they can be disabled or enabled at run time.
+ */
+#undef CONFIG_RESTRICTED_CONSOLE_COMMANDS
+
+/* The default .flags field value is zero, unless overridden with this. */
+#undef CONFIG_CONSOLE_COMMAND_FLAGS_DEFAULT
+
 /*
  * Number of entries in console history buffer.
  *
diff --git a/include/console.h b/include/console.h
index f0c96a167f..e82cd128cb 100644
--- a/include/console.h
+++ b/include/console.h
@@ -20,10 +20,29 @@ struct console_command {
 	/* Description of args */
 	const char *argdesc;
 	/* Short help for command */
-	const char *shorthelp;
+	const char *help;
+#endif
+#ifdef CONFIG_CONSOLE_COMMAND_FLAGS
+	const uint32_t flags;
 #endif
 };
 
+/* Flag bits for when CONFIG_CONSOLE_COMMAND_FLAGS is enabled */
+#define CMD_FLAG_RESTRICTED  0x00000001
+
+/* The default .flags value can be overridden in board.h */
+#ifndef CONFIG_CONSOLE_COMMAND_FLAGS_DEFAULT
+#define CONFIG_CONSOLE_COMMAND_FLAGS_DEFAULT 0
+#endif
+
+#ifdef CONFIG_RESTRICTED_CONSOLE_COMMANDS
+/*
+ * This must be implemented somewhere. A true return value means that all
+ * CMD_FLAG_RESTRICTED commands are disabled.
+ */
+int console_is_restricted(void);
+#endif
+
 /* Console channels */
 enum console_channel {
 	#define CONSOLE_CHANNEL(enumeration, string) enumeration,
@@ -94,19 +113,20 @@ void console_has_input(void);
 /**
  * Register a console command handler.
  *
- * @param name		Command name; must not be the beginning of another
- *			existing command name.  Note this is NOT in quotes
- *		        so it can be concatenated to form a struct name.
- * @param routine	Command handling routine, of the form
- *			int handler(int argc, char **argv)
- * @param argdesc	String describing arguments to command; NULL if none.
- * @param shorthelp	String with one-line description of command.
+ * @param name          Command name; must not be the beginning of another
+ *                      existing command name.  Note this is NOT in quotes
+ *                      so it can be concatenated to form a struct name.
+ * @param routine       Command handling routine, of the form
+ *                      int handler(int argc, char **argv)
+ * @param argdesc       String describing arguments to command; NULL if none.
+ * @param help          String with one-line description of command, or NULL.
+ * @param flags         Per-command flags, if needed.
  */
 #ifndef HAS_TASK_CONSOLE
-#define DECLARE_CONSOLE_COMMAND(NAME, ROUTINE, ARGDESC, SHORTHELP)	\
+#define DECLARE_CONSOLE_COMMAND(NAME, ROUTINE, ARGDESC, HELP)	\
 	int (ROUTINE)(int argc, char **argv) __attribute__((unused))
 #elif defined(CONFIG_CONSOLE_CMDHELP)
-#define DECLARE_CONSOLE_COMMAND(NAME, ROUTINE, ARGDESC, SHORTHELP)	\
+#define DECLARE_CONSOLE_COMMAND(NAME, ROUTINE, ARGDESC, HELP)	\
 	static const char __con_cmd_label_##NAME[] = #NAME;		\
 	struct size_check##NAME {					\
 		int field[2 * (sizeof(__con_cmd_label_##NAME) < 16) - 1]; }; \
@@ -115,10 +135,10 @@ void console_has_input(void);
 	{ .name = __con_cmd_label_##NAME,				\
 	  .handler = ROUTINE,						\
 	  .argdesc = ARGDESC,						\
-	  .shorthelp = SHORTHELP					\
+	  .help = HELP					\
 	}
 #else
-#define DECLARE_CONSOLE_COMMAND(NAME, ROUTINE, ARGDESC, SHORTHELP)	\
+#define DECLARE_CONSOLE_COMMAND(NAME, ROUTINE, ARGDESC, HELP)	\
 	static const char __con_cmd_label_##NAME[] = #NAME;		\
 	struct size_check##NAME {					\
 		int field[2 * (sizeof(__con_cmd_label_##NAME) < 16) - 1]; }; \