A payment processor's NOC gives junior administrators read-only access to 40 routers through ISE TACACS+. Policy requires that they run only show commands, that anything else is denied by default, and that the same rule behaves identically across IOS and IOS-XE devices regardless of the command tables stored locally. Which TACACS+ authorization element should enforce this per-command restriction?

A TACACS+ command set that permits commands matching a show regular expression and ends with a deny-all rule is the right enforcement element. ISE evaluates each requested command centrally, allowing show commands while rejecting every command that is not explicitly permitted; applying the same set across devices avoids relying on differences in locally stored IOS and IOS-XE command tables. Local parser views can constrain command access, but they must be configured on each router and depend on that device’s local command support, so they do not provide the required consistent, centralized behavior. A command set that permits show commands plus approved diagnostic commands can still deny unlisted commands by default, but allowing those additional commands violates the show-only policy. A command set that permits show commands and explicitly denies listed non-show commands is also insufficient: unmatched commands are left to device policy, so an unlisted command may be allowed and behavior may vary across platforms. Exam caveat: privilege levels and parser views can restrict access, but they are not substitutes for a centrally enforced per-command TACACS+ rule when platform-independent behavior is required. Practical check: test representative show, configuration, and unlisted commands on both IOS and IOS-XE devices, confirming that only commands matching the show rule are authorized.