A network administrator needs to implement centralized AAA for a fleet of routers and switches. A key requirement is granular per-command authorization, so that junior technicians can execute only a specific subset of CLI commands while senior engineers retain full access. Which protocol best satisfies this requirement?