diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0ed3925..a07240c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.2.0a37 (2025-12-30)
+
+### Fix
+
+- update doc
+- update tests
+
 ## 0.2.0a36 (2025-12-22)
 
 ### Fix
diff --git a/pyproject.toml b/pyproject.toml
index 1e0d77f..956c990 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ requires = ["flit_core >=3.8.0,<4"]
 
 [project]
 name = "rougail.cli"
-version = "0.2.0a36"
+version = "0.2.0a37"
 authors = [{name = "Emmanuel Garette", email = "gnunux@gnunux.info"}]
 readme = "README.md"
 description = "CLI for Rougail"
diff --git a/src/rougail/cli/__main__.py b/src/rougail/cli/__main__.py
index c34d997..5ba8a9f 100644
--- a/src/rougail/cli/__main__.py
+++ b/src/rougail/cli/__main__.py
@@ -185,9 +185,12 @@ def load_user_data(rougailconfig):
         read_only = set()
         if rougailconfig["cli.inaccessible_read_write_modes"]:
             read_write = set(rougailconfig["cli.inaccessible_read_write_modes"])
+        if rougailconfig["cli.inaccessible_read_only_modes"]:
+            read_only = set(rougailconfig["cli.inaccessible_read_only_modes"])
         if rougailconfig["cli.inaccessible_modes"]:
-            read_only = set(rougailconfig["cli.inaccessible_modes"])
-            read_write |= read_only
+            modes = set(rougailconfig["cli.inaccessible_modes"])
+            read_only |= modes
+            read_write |= modes
         if read_write:
             subconfig.property.setdefault(
                 frozenset(subconfig.property.default("read_write", "append") | read_write), "read_write", "append"
diff --git a/src/rougail/cli/__version__.py b/src/rougail/cli/__version__.py
index e00824e..1737292 100644
--- a/src/rougail/cli/__version__.py
+++ b/src/rougail/cli/__version__.py
@@ -1 +1 @@
-__version__ = "0.2.0a36"
+__version__ = "0.2.0a37"
diff --git a/src/rougail/cli/config.py b/src/rougail/cli/config.py
index ad29df9..37c37dd 100644
--- a/src/rougail/cli/config.py
+++ b/src/rougail/cli/config.py
@@ -80,6 +80,23 @@ cli:
       - description
     default: description
 
+  inaccessible_read_only_modes:
+    description: {_('Modes that should not be accessible in read_only mode')}
+    multi: true
+    mandatory: false
+    disabled:
+      jinja: |
+        {{{{ not modes_level }}}}
+      return_type: boolean
+      description: {_('if any mode is set in "modes_level"')}
+    validators:
+      - type: jinja
+        jinja: |
+          {{% if _.inaccessible_read_only_modes not in modes_level %}}
+          not in modes_level ({{modes_level}})
+          {{% endif %}}
+        description: {_('mode must exists in "modes_level"')}
+
   inaccessible_read_write_modes:
     description: {_('Modes that should not be accessible in read_write mode')}
     multi: true