A network administrator is configuring TACACS+ device administration in Cisco ISE for a Cisco Wireless LAN Controller (WLC). Help desk staff must log in to the WLC and receive read-only (MONITOR) access automatically upon authentication, without being prompted for further privilege changes. The WLC uses vendor-specific TACACS+ custom attributes to convey the role. Where in the ISE TACACS+ policy result should the administrator define the attribute 'role1=MONITOR' so it is returned during the session authorization?