permission denied when trying to save config as radius authenticated user in tmsh

btw here is the workaround I'm currently using:

 
proc script::run {} {
    puts -nonewline "password: "
    flush stdout
    catch { exec /bin/su -c "tmsh save /sys config" } output
    puts ""
    set output [string map { "Password:" "" } $output]
    puts $output
    return 0
}

So I can as a radius user run that script which calls su which calls tmsh (as root) and does the save. This works but is insufficient. I'd need a solution without being asked for the root password.