Looking for example authorization command sets for mid-privilege users

[CommKeeper]

We recently started moving our devices back to TACACS authentication from RADIUS. We had this on ACS, but when we migrated to ISE it only supported RADIUS at the time. Now that we can do authorization sets again, I am curious as to what command sets you consider safe for Contractors or Junior Admins. I know this can vary by platform, but just looking for some ideas as we look to lock down these users command sets.

[Sheraz.Salim]

There are plenty of resource on cisco website here 

[CommKeeper]

Thanks for sharing this link. I do understand how to set this up, but I'm just looking for some command sets others have used for roles such as these. I did not see that type of examples in the document link outside of 'show'.

Example:

Junior Admin

Permitted

#show

(config)# hostname

(config-if)# switchport

(config-if)# authentication

(config-if)# dot1x

(config-if)# service-policy

Denied

(config)# ip route

(config)# interface vlan

(config)# aaa

...etc.etc..

[Sheraz.Salim]

check this page it has all the required information might be helpful for you here 

[Greg Gibbs]

TACACS+ Command Sets should be based on specific business requirements, so they are rarely "one size fits all"

You can find some examples in the following video, but you'll need to use the same methodology to develop your required Command Sets. You would typically want to test these extensively in a non-Prod environment as well before deploying into Production.

ISE 2.0: TACACS+ Command Authorization