This is a bitmask indicating which AAA (authentication, authorization, accounting) roles the configured server is permitted to perform, with the authentication, authorization, and accounting bits each set or cleared independently. Because a single RADIUS/TACACS+ server can be limited to just verifying identity or can also grant permissions and log usage, this field tells an administrator exactly which of those three jobs the device will route to that server. For example, if only the authentication bit is set, the device will still send this server login credentials to validate but will rely on a different server for authorization and accounting duties.