In the Network Policy, add a Vendor Specific Attribute.  Chose Cisco as the vendor, Cisco-AV-Pair as the name.

Add these two Attribute Values:

priv-lvl=15
shell:roles=*"network-admin vdc-admin"