When you add an operator configuration at a specified level (helper, oper, sa, csop, root) there are a number of commands that come with that access level. The flag command lets you get very specific about what each operator can or cannot do. This gives you very complete control over your environment.
AKILL - Place a network wide ban on a user@host address.
CDROP - Drop registered channels without being the founder.
CPASSWD - Modify channel passwords, and to mark channels.
CCLOSE - Close and reopen channels.
CFORCEREG - Register channels without having operator status in them.
CWIPE - Wipe ChanServ access lists without owning the nickname.
FREEZE - Suspend nicknames and channels.
GLOBAL - Send notices to all the users on the network.
HELPER - Receive Helpop notices.
IGNORE - Modify the services ignore list.
MASSDEOP - Remove operator status from all users in a channel.
MASSKICK - Remove all users from a channel.
NDROP - Drop registered nicknames without being the owner.
NPASSWD - Modify nickname passwords, and to mark nicknames.
NWIPE - Wipe NickServ access lists without owning the nickname.
SQLINE - Modify the services qline list.
TRIGGER - Modify the clone detection threshold for a host or user@host address.
Examples:
/os opercfg Mark akill del
Used in conjunction with the PRIVILEGE command set this will give you very finite control over the commands that all users have access to. To get a complete list of the commands a specific Operator has access to, use the LIST command.