Cisco’s device-administration AAA protocol: TCP 49, entire payload encrypted, and the three A’s are separate decisions — you can authenticate via TACACS+ while authorising commands elsewhere. That command-level authorization is why ENCOR prefers it for CLI access.

aaa new-model
tacacs server TAC1
 address ipv4 10.10.10.20
 key cisco123
aaa authentication login default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting commands 15 default stop-only group tacacs+

vs RADIUS in one line: UDP + password-only crypto + bundled AAA (RADIUS, network access) vs TCP + full encryption + separated exec/command authorization (TACACS+, device admin). Full command accounting is the compliance win: who typed reload and when.