Have you tried the following:
For the Avaya 5500, you can set an Enforcement Profile that returns RADIUS IETF attribute Service-Type to either 6 or 7 for the following permissions. I am not sure anyting more granular exists.:
- 6 returns Administrative (read/write)
- 7 returns NAS Prompt (read only)