A network administrator has deployed a TACACS+ server to control access to the company's routers. After a junior technician successfully logs in to a router, the administrator wants to ensure that the technician is only permitted to run a limited set of show commands and cannot enter configuration mode. Which AAA component enforces this restriction?