https://tacacs.net/docs/TACACS_Advantages.pdf
The primary functional difference between RADIUS and TACACS+ is that TACACS+ separates out the Authorization functionality, where RADIUS combines both Authentication and Authorization.
https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service- radius/12433-32.html Authentication and Authorization The RADIUS server can support a variety of methods to authenticate a user. When it is provided with the username and original password given by the user, it can support PPP, PAP or CHAP, UNIX login, and other authentication mechanisms.
Typically, a user login consists of a query (Access-Request) from the NAS to the RADIUS server and a corresponding response (Access-Accept or Access-Reject) from the server. The Access- Request packet contains the username, encrypted password, NAS IP address, and port.