In the terminal, some operating system commands require root privileges and some don't.  What is the mechanism for controlling this?  Is each command actually a separate program with its own execution permissions or is there a table in Bash? (Am I correct that Bash is the command shell and the terminal is a user interface that passes it commands?)  I'm referring to operating system commands as opposed to running applications from the terminal.
What is the mechanism for differentiating root requirements for terminal commands?
permissions;privileges
Yes each applications typically has it's own permissions set via permission bits on the actual application. You can see these if you use the command ls -l on the various executables that you're trying to run.$ ls -l /sbin/ | grep autrace-rwxr-x---. 1 root root     15792 Aug 24 14:40 autrace03:03:22-slm~ $ autracebash: /usr/sbin/autrace: Permission deniedBut there are some commands where the data that they'll attempt to touch/access is what's restricted so looking at the permissions is not sufficient:$ ls -l /sbin/ | grep \bfdisk-rwxr-xr-x. 1 root root    230512 Apr 25 05:19 fdisk$ fdisk -l$Here the command executed as my userid, but that user does not have permissions to access the information about the physical disks on my system, and so fdisk shows me no output. If I elevate myself to root using sudo I can see the output as I intended:$ sudo fdisk -l | head -10Disk /dev/sda: 238.5 GiB, 256060514304 bytes, 500118192 sectorsUnits: sectors of 1 * 512 = 512 bytesSector size (logical/physical): 512 bytes / 512 bytesI/O size (minimum/optimal): 512 bytes / 512 bytesDisklabel type: gptDisk identifier: 5D1229E8-1234-1234-1234-ABCDEFG128790Device           Start          End   Size Type/dev/sda1         2048       411647   200M EFI SystemMechanisms that control thisThere is no centralized control, all the control is decentralized and stored with the files as permissions bits on either the applications/executables (as I showed above), or on the data files that these tools will use, or on the directories where the files are contained.Command shellYour description isn't quite right with respect to Bash being a shell, and the terminal being a user interface that passes it commands. Rather the terminal is an application that is executed, and within it there's a shell running, typically Bash but it can be any number of shells.For exampleHere's the output of the ps command that shows how the processes for my current shell are structured:$ ps axf | less... 8549 ?        Sl     0:08 /usr/libexec/gnome-terminal-server 8552 ?        S      0:00  \_ gnome-pty-helper10286 pts/13   Ss     0:00  \_ bash12783 pts/13   Sl+    5:49  |   \_ vinagre12868 pts/14   Ss     0:00  \_ bash15742 pts/14   R+     0:00      \_ ps axf15743 pts/14   S+     0:00      \_ less -rHere you can see that my terminal, gnome-terminal, is running on top and it has child processes underneath it. These child processes are 2 bash shells where one of them is running an application called vinagre and another is running this ps command that I'm showing you here.Additional restrictionsWhat I've described above is the foundation for how executables can be used by users on the system. But these are just the basics. Beyond these there are additional technologies such as ACL (Access Control Lists) and access control policies for the various exectuables.ACLs are pretty straightforward, giving users outside of the traditional model of owner, group, and other, a more granular control.Tools such as SELinux and AppArmor take this same approach but introduce at the Linux Kernel level the ability for rules to be put into place that restrict how application X can interact with the system as a whole. For example if you're running a Samba server, this application would need to be granted access to your filesystem outside of the normal areas that it would typically operate. You'd have to add extra policies to allow this.excerpt of SELinux man pageNSA  Security-Enhanced Linux (SELinux) is an implementation of a  flexible  mandatory access control architecture in the Linux operating  system.  The  SELinux architecture provides general support for the  enforcement of many kinds  of mandatory access control  policies,   including those based on the concepts of  Type Enforcement, Role-  Based Access Control, and Multi-Level Security.  Background  information and technical documentation about SELinux can be found at   http://www.nsa.gov/research/selinux.Command are part of what?If you're confused whether a application is an actual file on the system, or if it's something else you can use the command type to determine this.$ type pwdpwd is a shell builtin$ type fdiskfdisk is /usr/sbin/fdiskSo in the above examples, pwd is built into Bash, whereas fdisk is an actual file that resides at /usr/sbin/fdisk.NOTE: For anything that's built-in, they're governed by the permissions of the Bash shell from which they're being invoked!