From 682b61331f2c89e8dca0d9366bc8468c9e795e23 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Tue, 10 Mar 2026 20:32:47 -0700
Subject: [PATCH 01/18] add initial prefix filter

---
 release/models/aft/openconfig-aft-common.yang | 10 ++-
 .../aft/openconfig-aft-global-filter.yang     | 72 +++++++++++++++++++
 release/models/aft/openconfig-aft.yang        | 18 ++++-
 3 files changed, 97 insertions(+), 3 deletions(-)
 create mode 100644 release/models/aft/openconfig-aft-global-filter.yang

diff --git a/release/models/aft/openconfig-aft-common.yang b/release/models/aft/openconfig-aft-common.yang
index 67beb166b3..a92e6c34d5 100644
--- a/release/models/aft/openconfig-aft-common.yang
+++ b/release/models/aft/openconfig-aft-common.yang
@@ -23,7 +23,13 @@ submodule openconfig-aft-common {
     "Submodule containing definitions of groupings that are re-used
     across multiple contexts within the AFT model.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description
@@ -194,6 +200,7 @@ submodule openconfig-aft-common {
       "Structural grouping describing a next-hop entry.";
 
     container next-hops {
+      config false;
       description
         "The list of next-hops that are to be used for entry within
         the AFT table. The structure of each next-hop is address
@@ -868,6 +875,7 @@ submodule openconfig-aft-common {
       "Logical grouping for groups of next-hops.";
 
     container next-hop-groups {
+      config false;
       description
         "Surrounding container for groups of next-hops.";
 
diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
new file mode 100644
index 0000000000..c99c25c060
--- /dev/null
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -0,0 +1,72 @@
+submodule openconfig-aft-global-filter {
+  belongs-to "openconfig-aft" {
+    prefix "oc-aft";
+  }
+
+  import openconfig-extensions { prefix "oc-ext"; }
+  import openconfig-routing-policy { prefix "oc-rpol"; }
+
+  organization
+    "OpenConfig working group";
+
+  contact
+    "OpenConfig working group
+    www.openconfig.net";
+
+  description
+    "Submodule containing definitions of groupings for the global
+    filter configuration applicable to abstract forwarding tables.";
+
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance
+      AFT prefix filtering.";
+    reference "3.3.0";
+  }
+
+  grouping aft-global-filter-config {
+    description
+      "Configuration parameters for the AFT global filter.";
+
+    leaf policy-name {
+      type leafref {
+        path "/oc-rpol:routing-policy/oc-rpol:policy-definitions" +
+             "/oc-rpol:policy-definition/oc-rpol:config/oc-rpol:name";
+      }
+      description
+        "Reference to a routing policy that is used to filter the
+        prefixes that are installed into the AFT. Only prefixes that
+        are accepted by the referenced policy are installed.";
+    }
+  }
+
+  grouping aft-global-filter-structural {
+    description
+      "Structural grouping defining the schema for the global filter
+      applied to the abstract forwarding tables.";
+
+    container global-filter {
+      description
+        "Configuration and state for a global filter applied to the
+        AFT. The filter is used to restrict which prefixes are
+        installed into the AFT for the network instance.";
+
+      container config {
+        description
+          "Configuration parameters for the AFT global filter.";
+
+        uses aft-global-filter-config;
+      }
+
+      container state {
+        config false;
+        description
+          "Operational state parameters for the AFT global filter.";
+
+        uses aft-global-filter-config;
+      }
+    }
+  }
+}
diff --git a/release/models/aft/openconfig-aft.yang b/release/models/aft/openconfig-aft.yang
index 272bde5631..54dddc587b 100644
--- a/release/models/aft/openconfig-aft.yang
+++ b/release/models/aft/openconfig-aft.yang
@@ -22,6 +22,8 @@ module openconfig-aft {
   include openconfig-aft-common;
   // Include the state synced submodule.
   include openconfig-aft-state-synced;
+  // Include the global filter submodule.
+  include openconfig-aft-global-filter;
 
   organization
     "OpenConfig working group";
@@ -42,7 +44,13 @@ module openconfig-aft {
     is referred to as an Abstract Forwarding Table (AFT), rather than
     the FIB.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description
@@ -222,7 +230,6 @@ module openconfig-aft {
       AFT.";
 
     container afts {
-      config false;
       description
         "The abstract forwarding tables (AFTs) that are associated
         with the network instance. An AFT is instantiated per-protocol
@@ -234,6 +241,7 @@ module openconfig-aft {
         forwarding entry.";
 
       container ipv4-unicast {
+        config false;
         description
           "The abstract forwarding table for IPv4 unicast. Entries
           within this table are uniquely keyed on the IPv4 unicast
@@ -248,6 +256,7 @@ module openconfig-aft {
       }
 
       container ipv6-unicast {
+        config false;
         description
           "The abstract forwarding table for IPv6 unicast. Entries
           within this table are uniquely keyed on the IPv6 unicast
@@ -262,6 +271,7 @@ module openconfig-aft {
       }
 
       container policy-forwarding {
+        config false;
         description
           "The abstract forwarding table for policy-based forwarding
           entries. Since multiple match criteria can be utilised
@@ -279,6 +289,7 @@ module openconfig-aft {
       }
 
       container mpls {
+        config false;
         description
           "The abstract forwarding table for MPLS label based
           forwarding entries. Entries within the table are keyed based
@@ -289,6 +300,7 @@ module openconfig-aft {
       }
 
       container ethernet {
+        config false;
         description
           "The abstract forwarding table for Ethernet based forwarding
           entries. Entries within the table are keyed based on the
@@ -298,6 +310,7 @@ module openconfig-aft {
       }
 
       container state-synced {
+        config false;
         description
           "In some cases AFT streaming (e.g., over gNMI) is an eventually consistent system.
           When the device updates an entry it is usually expected to
@@ -320,6 +333,7 @@ module openconfig-aft {
 
       uses aft-next-hop-groups-structural;
       uses aft-nhop-structural;
+      uses aft-global-filter-structural;
     }
   }
 }

From 28cdc504a7790d1b5263568bb73d48d6d71d4c72 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Tue, 10 Mar 2026 20:50:28 -0700
Subject: [PATCH 02/18] version bump afts modules

---
 release/models/aft/openconfig-aft-ethernet.yang     | 8 +++++++-
 release/models/aft/openconfig-aft-ipv4.yang         | 8 +++++++-
 release/models/aft/openconfig-aft-ipv6.yang         | 8 +++++++-
 release/models/aft/openconfig-aft-mpls.yang         | 8 +++++++-
 release/models/aft/openconfig-aft-pf.yang           | 8 +++++++-
 release/models/aft/openconfig-aft-state-synced.yang | 8 +++++++-
 6 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/release/models/aft/openconfig-aft-ethernet.yang b/release/models/aft/openconfig-aft-ethernet.yang
index af225feb8a..916e696d0f 100644
--- a/release/models/aft/openconfig-aft-ethernet.yang
+++ b/release/models/aft/openconfig-aft-ethernet.yang
@@ -20,7 +20,13 @@ submodule openconfig-aft-ethernet {
     "Submodule containing definitions of groupings for the abstract
     forwarding tables for Ethernet.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description
diff --git a/release/models/aft/openconfig-aft-ipv4.yang b/release/models/aft/openconfig-aft-ipv4.yang
index 2b913d8fe2..01d18b60bb 100644
--- a/release/models/aft/openconfig-aft-ipv4.yang
+++ b/release/models/aft/openconfig-aft-ipv4.yang
@@ -20,7 +20,13 @@ submodule openconfig-aft-ipv4 {
     "Submodule containing definitions of groupings for the abstract
     forwarding tables for IPv4.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description
diff --git a/release/models/aft/openconfig-aft-ipv6.yang b/release/models/aft/openconfig-aft-ipv6.yang
index e1b2c6087c..64ced43b94 100644
--- a/release/models/aft/openconfig-aft-ipv6.yang
+++ b/release/models/aft/openconfig-aft-ipv6.yang
@@ -20,7 +20,13 @@ submodule openconfig-aft-ipv6 {
     "Submodule containing definitions of groupings for the abstract
     forwarding tables for IPv6.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description
diff --git a/release/models/aft/openconfig-aft-mpls.yang b/release/models/aft/openconfig-aft-mpls.yang
index 79bd72391e..5fb556cab6 100644
--- a/release/models/aft/openconfig-aft-mpls.yang
+++ b/release/models/aft/openconfig-aft-mpls.yang
@@ -21,7 +21,13 @@ submodule openconfig-aft-mpls {
     "Submodule containing definitions of groupings for the abstract
     forwarding table for MPLS label forwarding.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description
diff --git a/release/models/aft/openconfig-aft-pf.yang b/release/models/aft/openconfig-aft-pf.yang
index 67e3887c67..386c7166fc 100644
--- a/release/models/aft/openconfig-aft-pf.yang
+++ b/release/models/aft/openconfig-aft-pf.yang
@@ -28,7 +28,13 @@ submodule openconfig-aft-pf {
     fields other than the destination address that is used in
     other forwarding tables.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description
diff --git a/release/models/aft/openconfig-aft-state-synced.yang b/release/models/aft/openconfig-aft-state-synced.yang
index b5563233f5..ba7a535c34 100644
--- a/release/models/aft/openconfig-aft-state-synced.yang
+++ b/release/models/aft/openconfig-aft-state-synced.yang
@@ -16,7 +16,13 @@ submodule openconfig-aft-state-synced {
     "Submodule containing definitions of groupings for the state
     synced signals corresponding to various abstract forwarding tables.";
 
-  oc-ext:openconfig-version "3.2.0";
+  oc-ext:openconfig-version "3.3.0";
+
+  revision "2026-03-10" {
+    description
+      "Add global-filter container to support per-network-instance AFT prefix filtering.";
+    reference "3.3.0";
+  }
 
   revision "2025-08-07" {
     description

From ddcbed0425cfd81a735c4618ae33c867e4cce037 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Wed, 11 Mar 2026 11:32:41 -0700
Subject: [PATCH 03/18] add config false to aft-summary

---
 release/models/aft/openconfig-aft-summary.yang | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/release/models/aft/openconfig-aft-summary.yang b/release/models/aft/openconfig-aft-summary.yang
index 8a4cc1730c..7aec4d0294 100644
--- a/release/models/aft/openconfig-aft-summary.yang
+++ b/release/models/aft/openconfig-aft-summary.yang
@@ -39,6 +39,7 @@ module openconfig-aft-summary {
       "Grouping for protocol type state.";
 
     leaf origin-protocol {
+      config false;
       description
         "Protocol type that keys the protocol list.";
 
@@ -48,10 +49,12 @@ module openconfig-aft-summary {
     }
 
     container counters {
+      config false;
       description
       "Enclosing container for aft entry counters";
 
       leaf aft-entries {
+        config false;
         description
           "Total number of entries in the aft.";
         type uint64;

From 8076a1fc169f8ae471badc7605aa42bc5e3f588b Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Wed, 11 Mar 2026 12:09:03 -0700
Subject: [PATCH 04/18] fix config false in aft-summary

---
 release/models/aft/openconfig-aft-summary.yang | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/release/models/aft/openconfig-aft-summary.yang b/release/models/aft/openconfig-aft-summary.yang
index 7aec4d0294..3edd0ffdcb 100644
--- a/release/models/aft/openconfig-aft-summary.yang
+++ b/release/models/aft/openconfig-aft-summary.yang
@@ -20,7 +20,13 @@ module openconfig-aft-summary {
     "This module provides summary of aft entry counts per protocol type for each network
     instance.";
 
-  oc-ext:openconfig-version "0.2.0";
+  oc-ext:openconfig-version "0.2.1";
+
+  revision "2026-03-11" {
+    description
+      "Add config false to protocols and state containers.";
+    reference "0.2.1";
+  }
 
   revision "2024-01-12" {
     description
@@ -39,7 +45,6 @@ module openconfig-aft-summary {
       "Grouping for protocol type state.";
 
     leaf origin-protocol {
-      config false;
       description
         "Protocol type that keys the protocol list.";
 
@@ -49,12 +54,10 @@ module openconfig-aft-summary {
     }
 
     container counters {
-      config false;
       description
-      "Enclosing container for aft entry counters";
+        "Enclosing container for aft entry counters";
 
       leaf aft-entries {
-        config false;
         description
           "Total number of entries in the aft.";
         type uint64;
@@ -67,6 +70,7 @@ module openconfig-aft-summary {
       "A summary of aft entries by protocol type.";
 
     container protocols {
+      config false;
       description
         "Enclosing container for a list of protocols";
       list protocol {
@@ -84,6 +88,7 @@ module openconfig-aft-summary {
         }
 
         container state {
+          config false;
           description
             "State parameters for the aft entry list.";
           uses protocols-state;

From c062b67caa7199e075aec0d3090a4537f78b80b8 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 13 Mar 2026 18:08:41 +0000
Subject: [PATCH 05/18] replace generic AFT global filter policy with separate
 IPv4 and IPv6 policies.

---
 .../aft/openconfig-aft-global-filter.yang     | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index c99c25c060..771c1832f7 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -21,8 +21,8 @@ submodule openconfig-aft-global-filter {
 
   revision "2026-03-10" {
     description
-      "Add global-filter container to support per-network-instance
-      AFT prefix filtering.";
+      "Add global-filter container to support per-network-instance and per
+      AFT filtering, with routing policy split by address family.";
     reference "3.3.0";
   }
 
@@ -30,15 +30,26 @@ submodule openconfig-aft-global-filter {
     description
       "Configuration parameters for the AFT global filter.";
 
-    leaf policy-name {
+    leaf ipv4-policy {
       type leafref {
         path "/oc-rpol:routing-policy/oc-rpol:policy-definitions" +
              "/oc-rpol:policy-definition/oc-rpol:config/oc-rpol:name";
       }
       description
         "Reference to a routing policy that is used to filter the
-        prefixes that are installed into the AFT. Only prefixes that
-        are accepted by the referenced policy are installed.";
+        IPv4 prefixes that are installed into the AFT. Only prefixes
+        that are accepted by the referenced policy are installed.";
+    }
+
+    leaf ipv6-policy {
+      type leafref {
+        path "/oc-rpol:routing-policy/oc-rpol:policy-definitions" +
+             "/oc-rpol:policy-definition/oc-rpol:config/oc-rpol:name";
+      }
+      description
+        "Reference to a routing policy that is used to filter the
+        IPv6 prefixes that are installed into the AFT. Only prefixes
+        that are accepted by the referenced policy are installed.";
     }
   }
 

From 32c30d5233401ce11d9900c334ed8edd33b6767e Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 13 Mar 2026 18:14:27 +0000
Subject: [PATCH 06/18] add example routing policy behavior to description

---
 release/models/aft/openconfig-aft-global-filter.yang | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index 771c1832f7..916943a89e 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -38,7 +38,10 @@ submodule openconfig-aft-global-filter {
       description
         "Reference to a routing policy that is used to filter the
         IPv4 prefixes that are installed into the AFT. Only prefixes
-        that are accepted by the referenced policy are installed.";
+        that are accepted by the referenced policy are installed.
+        The policy may, for example, use an explicit prefix set to
+        match prefixes, or match prefixes that are more specific than
+        a given prefix.";
     }
 
     leaf ipv6-policy {
@@ -49,7 +52,10 @@ submodule openconfig-aft-global-filter {
       description
         "Reference to a routing policy that is used to filter the
         IPv6 prefixes that are installed into the AFT. Only prefixes
-        that are accepted by the referenced policy are installed.";
+        that are accepted by the referenced policy are installed.
+        The policy may, for example, use an explicit prefix set to
+        match prefixes, or match prefixes that are more specific than
+        a given prefix.";
     }
   }
 

From 048692ee7c95229926cdb3f9e46434fd23f169f2 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 13 Mar 2026 18:29:30 -0700
Subject: [PATCH 07/18] re-order to trigger CI

---
 release/models/aft/openconfig-aft-global-filter.yang | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index 916943a89e..207fc240f0 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -29,29 +29,28 @@ submodule openconfig-aft-global-filter {
   grouping aft-global-filter-config {
     description
       "Configuration parameters for the AFT global filter.";
-
-    leaf ipv4-policy {
+    leaf ipv6-policy {
       type leafref {
         path "/oc-rpol:routing-policy/oc-rpol:policy-definitions" +
              "/oc-rpol:policy-definition/oc-rpol:config/oc-rpol:name";
       }
       description
         "Reference to a routing policy that is used to filter the
-        IPv4 prefixes that are installed into the AFT. Only prefixes
+        IPv6 prefixes that are installed into the AFT. Only prefixes
         that are accepted by the referenced policy are installed.
         The policy may, for example, use an explicit prefix set to
         match prefixes, or match prefixes that are more specific than
         a given prefix.";
     }
 
-    leaf ipv6-policy {
+    leaf ipv4-policy {
       type leafref {
         path "/oc-rpol:routing-policy/oc-rpol:policy-definitions" +
              "/oc-rpol:policy-definition/oc-rpol:config/oc-rpol:name";
       }
       description
         "Reference to a routing policy that is used to filter the
-        IPv6 prefixes that are installed into the AFT. Only prefixes
+        IPv4 prefixes that are installed into the AFT. Only prefixes
         that are accepted by the referenced policy are installed.
         The policy may, for example, use an explicit prefix set to
         match prefixes, or match prefixes that are more specific than
@@ -59,6 +58,7 @@ submodule openconfig-aft-global-filter {
     }
   }
 
+
   grouping aft-global-filter-structural {
     description
       "Structural grouping defining the schema for the global filter

From 1a1608723949d9de8222e6e28d83a4b6986471ba Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 13 Mar 2026 18:43:52 -0700
Subject: [PATCH 08/18] change descriptions

---
 .../aft/openconfig-aft-global-filter.yang     | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index 207fc240f0..36fdb3f850 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -15,14 +15,14 @@ submodule openconfig-aft-global-filter {
 
   description
     "Submodule containing definitions of groupings for the global
-    filter configuration applicable to abstract forwarding tables.";
+     filter configuration applicable to abstract forwarding tables.";
 
   oc-ext:openconfig-version "3.3.0";
 
   revision "2026-03-10" {
     description
       "Add global-filter container to support per-network-instance and per
-      AFT filtering, with routing policy split by address family.";
+       AFT filtering, with routing policy split by address family.";
     reference "3.3.0";
   }
 
@@ -36,11 +36,11 @@ submodule openconfig-aft-global-filter {
       }
       description
         "Reference to a routing policy that is used to filter the
-        IPv6 prefixes that are installed into the AFT. Only prefixes
-        that are accepted by the referenced policy are installed.
-        The policy may, for example, use an explicit prefix set to
-        match prefixes, or match prefixes that are more specific than
-        a given prefix.";
+         IPv6 prefixes that are present in the FIB. Only prefixes
+         that are accepted by the referenced policy are streamed.
+         The policy may, for example, use an explicit prefix set to
+         match prefixes, or match prefixes that are more specific than
+         a given prefix.";
     }
 
     leaf ipv4-policy {
@@ -50,11 +50,11 @@ submodule openconfig-aft-global-filter {
       }
       description
         "Reference to a routing policy that is used to filter the
-        IPv4 prefixes that are installed into the AFT. Only prefixes
-        that are accepted by the referenced policy are installed.
-        The policy may, for example, use an explicit prefix set to
-        match prefixes, or match prefixes that are more specific than
-        a given prefix.";
+         IPv4 prefixes that are in the FIB. Only prefixes
+         that are accepted by the referenced policy are streamed.
+         The policy may, for example, use an explicit prefix set to
+         match prefixes, or match prefixes that are more specific than
+         a given prefix.";
     }
   }
 
@@ -62,13 +62,13 @@ submodule openconfig-aft-global-filter {
   grouping aft-global-filter-structural {
     description
       "Structural grouping defining the schema for the global filter
-      applied to the abstract forwarding tables.";
+       applied to the abstract forwarding tables.";
 
     container global-filter {
       description
         "Configuration and state for a global filter applied to the
-        AFT. The filter is used to restrict which prefixes are
-        installed into the AFT for the network instance.";
+         AFT. The filter is used to restrict which prefixes are
+         installed into the AFT for the network instance.";
 
       container config {
         description

From 816165a4dfc862cd23b5c8049f123df01e428444 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Mon, 16 Mar 2026 15:20:31 +0000
Subject: [PATCH 09/18] submodule to augment

---
 release/models/aft/.spec.yml                    |  2 ++
 .../aft/openconfig-aft-global-filter.yang       | 17 ++++++++++++-----
 release/models/aft/openconfig-aft.yang          |  3 ---
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/release/models/aft/.spec.yml b/release/models/aft/.spec.yml
index 23c0d75b7b..249e3adec8 100644
--- a/release/models/aft/.spec.yml
+++ b/release/models/aft/.spec.yml
@@ -4,9 +4,11 @@
     - yang/aft/openconfig-aft-counters.yang
     - yang/aft/openconfig-aft-types.yang
     - yang/aft/openconfig-aft-summary.yang
+    - yang/aft/openconfig-aft-global-filter.yang
   build:
     - yang/network-instance/openconfig-network-instance.yang
     - yang/aft/openconfig-aft-network-instance.yang
     - yang/aft/openconfig-aft-counters.yang
     - yang/aft/openconfig-aft-summary.yang
+    - yang/aft/openconfig-aft-global-filter.yang
   run-ci: true
diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index 36fdb3f850..f4ad72c6ab 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -1,9 +1,9 @@
-submodule openconfig-aft-global-filter {
-  belongs-to "openconfig-aft" {
-    prefix "oc-aft";
-  }
+module openconfig-aft-global-filter {
+  namespace "http://openconfig.net/yang/aft/global-filter";
+  prefix "oc-aft-gf";
 
   import openconfig-extensions { prefix "oc-ext"; }
+  import openconfig-network-instance { prefix "oc-ni"; }
   import openconfig-routing-policy { prefix "oc-rpol"; }
 
   organization
@@ -14,7 +14,7 @@ submodule openconfig-aft-global-filter {
     www.openconfig.net";
 
   description
-    "Submodule containing definitions of groupings for the global
+    "Module containing definitions of groupings for the global
      filter configuration applicable to abstract forwarding tables.";
 
   oc-ext:openconfig-version "3.3.0";
@@ -86,4 +86,11 @@ submodule openconfig-aft-global-filter {
       }
     }
   }
+
+  augment "/oc-ni:network-instances/oc-ni:network-instance/oc-ni:afts" {
+    description
+      "Add global filter to AFT tree.";
+
+    uses aft-global-filter-structural;
+  }
 }
diff --git a/release/models/aft/openconfig-aft.yang b/release/models/aft/openconfig-aft.yang
index 54dddc587b..f673514092 100644
--- a/release/models/aft/openconfig-aft.yang
+++ b/release/models/aft/openconfig-aft.yang
@@ -22,8 +22,6 @@ module openconfig-aft {
   include openconfig-aft-common;
   // Include the state synced submodule.
   include openconfig-aft-state-synced;
-  // Include the global filter submodule.
-  include openconfig-aft-global-filter;
 
   organization
     "OpenConfig working group";
@@ -333,7 +331,6 @@ module openconfig-aft {
 
       uses aft-next-hop-groups-structural;
       uses aft-nhop-structural;
-      uses aft-global-filter-structural;
     }
   }
 }

From eb1de08abe8a5dc37f60390075f52ea1ac5439e5 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 3 Apr 2026 17:13:57 +0000
Subject: [PATCH 10/18] update to run CI

---
 release/models/aft/openconfig-aft-global-filter.yang | 1 +
 1 file changed, 1 insertion(+)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index f4ad72c6ab..35b53d599e 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -19,6 +19,7 @@ module openconfig-aft-global-filter {
 
   oc-ext:openconfig-version "3.3.0";
 
+
   revision "2026-03-10" {
     description
       "Add global-filter container to support per-network-instance and per

From b40839e0a9e07ee23c8388cedc3c083ea9fcc4fe Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 3 Apr 2026 17:14:46 +0000
Subject: [PATCH 11/18] update to run CI (revert)

---
 release/models/aft/openconfig-aft-global-filter.yang | 1 -
 1 file changed, 1 deletion(-)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index 35b53d599e..f4ad72c6ab 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -19,7 +19,6 @@ module openconfig-aft-global-filter {
 
   oc-ext:openconfig-version "3.3.0";
 
-
   revision "2026-03-10" {
     description
       "Add global-filter container to support per-network-instance and per

From 421a30ee0d9d4eae7cd403e5d9bae1a27a04c477 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 3 Apr 2026 22:08:12 +0000
Subject: [PATCH 12/18] modify to CI

---
 release/models/aft/openconfig-aft-global-filter.yang | 1 +
 1 file changed, 1 insertion(+)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index f4ad72c6ab..588cbd81bf 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -6,6 +6,7 @@ module openconfig-aft-global-filter {
   import openconfig-network-instance { prefix "oc-ni"; }
   import openconfig-routing-policy { prefix "oc-rpol"; }
 
+
   organization
     "OpenConfig working group";
 

From 866b27315c3bd9e9acc18d01133d3fce60bb3347 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 3 Apr 2026 23:09:29 +0000
Subject: [PATCH 13/18] modify to CI

---
 release/models/aft/openconfig-aft-global-filter.yang | 1 -
 1 file changed, 1 deletion(-)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index 588cbd81bf..f4ad72c6ab 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -6,7 +6,6 @@ module openconfig-aft-global-filter {
   import openconfig-network-instance { prefix "oc-ni"; }
   import openconfig-routing-policy { prefix "oc-rpol"; }
 
-
   organization
     "OpenConfig working group";
 

From 257420323a97a2c679e94fb4361762344fe945e2 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 3 Apr 2026 23:13:41 +0000
Subject: [PATCH 14/18] modify to CI

---
 release/models/aft/openconfig-aft-global-filter.yang | 1 +
 1 file changed, 1 insertion(+)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index f4ad72c6ab..588cbd81bf 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -6,6 +6,7 @@ module openconfig-aft-global-filter {
   import openconfig-network-instance { prefix "oc-ni"; }
   import openconfig-routing-policy { prefix "oc-rpol"; }
 
+
   organization
     "OpenConfig working group";
 

From f52c1918e576c87ea1a7bfb1d41557030e2a8085 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 3 Apr 2026 23:17:42 +0000
Subject: [PATCH 15/18] modify to CI

---
 release/models/aft/openconfig-aft-global-filter.yang | 1 -
 1 file changed, 1 deletion(-)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index 588cbd81bf..f4ad72c6ab 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -6,7 +6,6 @@ module openconfig-aft-global-filter {
   import openconfig-network-instance { prefix "oc-ni"; }
   import openconfig-routing-policy { prefix "oc-rpol"; }
 
-
   organization
     "OpenConfig working group";
 

From c1ba943bfbf8460166467804b539ad982e6d74eb Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Fri, 3 Apr 2026 23:59:54 +0000
Subject: [PATCH 16/18] modify to CI

---
 release/models/aft/openconfig-aft-global-filter.yang | 1 +
 1 file changed, 1 insertion(+)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index f4ad72c6ab..588cbd81bf 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -6,6 +6,7 @@ module openconfig-aft-global-filter {
   import openconfig-network-instance { prefix "oc-ni"; }
   import openconfig-routing-policy { prefix "oc-rpol"; }
 
+
   organization
     "OpenConfig working group";
 

From eb1a6c853ad51883a31dd57d2f1a4b65addb5094 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Sat, 4 Apr 2026 00:04:41 +0000
Subject: [PATCH 17/18] modify to CI

---
 release/models/aft/openconfig-aft-global-filter.yang | 1 -
 1 file changed, 1 deletion(-)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index 588cbd81bf..f4ad72c6ab 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -6,7 +6,6 @@ module openconfig-aft-global-filter {
   import openconfig-network-instance { prefix "oc-ni"; }
   import openconfig-routing-policy { prefix "oc-rpol"; }
 
-
   organization
     "OpenConfig working group";
 

From e4534cbaaff3ce52eec24ea242ebf08705889965 Mon Sep 17 00:00:00 2001
From: ElodinLaarz <caleblgeiger@gmail.com>
Date: Tue, 7 Apr 2026 07:53:49 -0700
Subject: [PATCH 18/18] update language installed -> streamed

---
 release/models/aft/openconfig-aft-global-filter.yang | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/release/models/aft/openconfig-aft-global-filter.yang b/release/models/aft/openconfig-aft-global-filter.yang
index f4ad72c6ab..cf4bf00047 100644
--- a/release/models/aft/openconfig-aft-global-filter.yang
+++ b/release/models/aft/openconfig-aft-global-filter.yang
@@ -67,8 +67,15 @@ module openconfig-aft-global-filter {
     container global-filter {
       description
         "Configuration and state for a global filter applied to the
-         AFT. The filter is used to restrict which prefixes are
-         installed into the AFT for the network instance.";
+         AFT. The filter is used to restrict which prefixes from the
+         network instance's AFT are streamed via gNMI; it does not
+         affect which prefixes are installed in the forwarding plane
+         (hardware FIB). All gNMI clients subscribing to the IPv4 or
+         IPv6 AFT for this network instance will only receive data
+         corresponding to prefixes accepted by the configured
+         filter policy. Prefixes rejected by the policy are omitted
+         from the streamed AFT state for every subscriber, regardless
+         of the client.";
 
       container config {
         description