Hi there
you can try 2 things,
1 Assign commands to certain privilege levels, and assign a certain privilege level to a user on the tacacs server
see this
privilege interface level 9 shutdown
privilege interface level 9 description
privilege configure level 9 interface
privilege exec level 9 configure terminal
privilege exec level 9 configure
privilege exec level 9 write memory
privilege exec level 9 write
privilege exec level 0 traceroute
privilege exec level 0 ping
privilege exec level 0 show ip bgp summary
privilege exec level 0 show ip bgp
privilege exec level 0 show ip
2 Configure command authorisation, let the tacacs server decide if you can execute a command