After seeing the 403 I dug a bit deeper
It appears that the user for the rack controller workers is missing the view-all permission.
https://github.com/maas/maas/blob/master/src/maasserver/worker_user.py#L24
After granting that user superuser permission automated tags just worked™
sudo -u postgres psql -d maasdb -c “UPDATE auth_user set is_superuser=true where username=‘MAAS’”