B. TACACS+ is best suited for granular command-level control due to its ability to separate authentication and authorization.