Edit Data Group Only Permissions

I have tried to achieve simliar goal in my prod

 

there is a default issue for this deployment

 

1:account with "manager" role can't save the config vis CLI............

 

2:if I assign role "admin " or "resource admin" to an account(which can fix the CLI no-save issue in 1.),but by default this account can access to objects in common partition

 

anyway I use perl to achieve this:limit access for some specific accounts and use "root" to save the config after each change made by these specific accounts