Cisco AAA/Identity/Nac :: New ACS 5.4 Install / Can’t Create Rules For Any Policies

I have a fresh install of an ACS 5.4 virtual  appliance. This ACS instance will only be used for TACACS+ AAA for network  device administration. It is up and running on the network. I have time,  timezone, NTP and DNS configured. ACS admin accounts  and logging are configured. I created an internal user, a network  device, a network device group, an internal identity group, a shell  profile, and command set. It is joined to the Enterprise Active  directory domain, and a couple of AD groups have been selected  for use in policies.The default network device is enabled and  configured with a TACACS secret. I have a lab router configured and  pointed at ACS and I can SSH to it with the ACS internal user.The problem is: I can’t create any rules for any  policies. If I try to add a rule (or edit a default rule) to the “Service Selection Rules” or  “Default Device Admin” or Identity, group mapping or authorization, all I  get is a popup with the message “Resource not  found or Internal  Server error”. If I click “customize” anywhere I  just get empty selection/transfer boxes. If I try to change to a single  result policy from compound rules I get a “System failure – your changes  were not saved” message.  I have installed  this twice now with the same results.This is my first experience with ACS. I’ve gotten  through most of the configuration guide but I don’t know ACS well enough  to know if I’m missing something incredibly obvious, or whether it’s  just broken.