This counter records outright denials of authorization requests, meaning the TACACS+ server is up and responding but is refusing to let the switch execute the specific command a logged-in user just attempted. Unlike an authentication reject, which blocks a login entirely, an authorization reject lets the admin see other command output but throws a command-authorization-failed error on that one specific command, so a spike here usually maps to privilege-level or command-set restrictions rather than a bad password. For example, this would increment every time a level-7 operator tries to run a level-15 'reload' command that TACACS+ policy blocks.