An engineer must configure a router to allow users to run specific configuration commands by validating the user against the router database. Which configuration must be applied?

The `aaa authentication network default local` command configures authentication for network services (e.g., PPP, 802.1X), not for user command execution on the router itself.

The `aaa authorization network default local` command configures authorization for network services, not for command execution on the router.

The `aaa authentication exec default local` command configures user authentication for console or VTY access (exec mode), but it determines *who* can log in, not *what* commands they are authorized to run.

The `aaa authorization exec default local` command configures the router to authorize command execution (exec mode) using the local user database, allowing granular control over which commands a user with a specific privilege level can run.