Operational mode commands are divided into subtrees depending on their purpose and their impract on the system. You must follow these guidelines to make it easy for users to predict the impact of a command.
The top level words are:
|Non-disruptive. Displays information, but never modifies the system state in any way.
|Non-disruptive. Modifies the system state in a way that doesn't impact any service. Clearing packet counters is a perfect example.
|Locally disruptive. Has a limited impact on the service, for example, resets a single VPN tunnel or a BGP session.
|Disruptive. Restarts an entire service, e.g. StrongSWAN process (which drops all IPsec connections).
|Locally disruptive. Forces a resource release or update.
Do not create new top level words without a really good reason.
Think of completion usability. A common mistake is to make a rarely used command that shares a prefix with a commonly used command, like "show system-integrity" (uncommonly used) when "show system" subtree has many common commands. In that case a user has to hit Tab twice for "show system commit", even though 99% of the time a command from the "show system" subtree is what they want.