Raw show running-config diffs are mostly timestamps and salted hashes. Normalize both sides, classify what remains, then gate changes by risk class.