This optional parameter specifies Tacacs+ authorisation attribute-value pairs that are to replace those suggested by the Tacacs+ client. It effectively overrides the default authorisation that the client would use.

You can have as many AuthorizationReplace parameters as you wish, one for each Tacacs+ authorisation attribute-value pair:

AuthorizationReplace service=aironet
AuthorizationReplace protocol=shell
AuthorizationReplace aironet:admin-capability=ident+admin