A hospital's network security team wants to control not only which administrators can log in to the core switches, but also which specific configuration commands each administrator is permitted to run once logged in. Which AAA protocol is built to authorize individual commands like this?

TACACS+ was designed for device administration and separates the AAA steps cleanly, which lets it perform per-command authorization: after a login is authenticated, each command the administrator types can be sent to the TACACS+ server and individually approved or denied based on that person's assigned privilege level or command set. This is exactly what the security team is asking for — restricting a junior administrator to read-only commands while a senior engineer retains full configuration rights, all enforced centrally rather than per device. RADIUS authenticates the login and can push a privilege level in its response, but it was built around network access scenarios and does not send each subsequent command back to the server for a separate authorization decision the way TACACS+ does. SNMPv3 is a protocol for polling and setting device state remotely; it plays no role in deciding whether a human typing into a CLI session is allowed to issue a given command. Syslog only records events after the fact for auditing — it never blocks or permits anything, so it cannot enforce command restrictions in real time. A caveat: TACACS+ command authorization only works if the server is reachable, so a fallback local authentication method should exist for when it isn't. A concrete check is attempting a restricted command as a limited-privilege account and confirming the TACACS+ server logs and denies it.