A company uses HPE Aruba Networking ClearPass Policy Manager (CPPM) as a TACACS+ server to...

To control which commands managers are allowed to execute on AOS-CX switches using ClearPass Policy Manager (CPPM) as a TACACS+ server, you must configure the Shell service in the TACACS+ enforcement profile. The Shell service provides the ability to define granular access controls for commands. It supports policy-driven command authorization, which is essential in controlling administrative tasks based on roles.

References

Official HPE Aruba ClearPass documentation on TACACS+ integration and command authorization.

Industry best practices for AAA (Authentication, Authorization, and Accounting) configuration in network security architectures.