Add these to your tacacs profiles, under policy results > tacacs profiles > (create new profile) > add custome attributes vsys=rootprivilege=root

I ran into the same issue and had to create a new shell profile with custom attributes:   Type - Mandatory, Name - vsys, value - root Type - Mandatory, Name - privilege, value - root