Use TACACS+ and command authorization. You will need to set up a generic command authorization set that allows all commands and one command authorization set that rejects any command except "show isdn active". You will also have to configure each network device to handle T+ command authorization.