as per the document from developer, the account needs the below xml api privileges.
Feature Permission Needed
Commands: pantag, panuserupdate User-ID Agent
Alert Action - Tag to Dynamic Address List User-ID Agent
Command: pancontentpack with PAN-OS < 8.0 Configuration
Command: pancontentpack with PAN-OS >= 8.0 Configuration and Operational Requests
can you please explain what you are trying to do, based on that we can answer the access problem. I followed the steps mentioned in the document and was able to configure the TA with firewall\panorama.