You need to do what:
-create acl template
-add role and authorization profile to the template
-apply the template to specific objects in the workspaces? (which workspaces)
1. All the below mention task to to be done.
did you ever figure this out? it should be straightforward w/ the blcli commands - look in the blcli help.