Yes, you can go that route. Within TACACS+ authentication policy you can set conditions such as "Network-Access Username EQUALS <username> AND Device-Hostname EQUALS <hostname>". Do not quote me on those condition names, as I do not have them handy t...