that is correct, you can define a tacacs set per SDR, but the asr9k only supports one SDR (as opposed to CRS which can have multiples).
other then using command authorization or task groups, which will apply system wide, is the most granular control you have with tacacs in xr/a9k.
xander