Telnet Control Through RAS

We use RAS with AAA in our company.

1. Is it true RAS/AAA can ONLY control the user to the first server?

2. Is there any products that can control the user from telneting from an first/authorizied server to an unauthorized server not on the AAA access list?

Thank you.