We have a service account in our ACS that will need to do a show running-config in our devices and nothing else. I've been trying to have ACS dictate what commands the account can and cannot use but it seems I can't get the system to lock down the us...