Help! ACS, v11.6, variable substitution for multiple user roles in multiple partitions?

v11.6 allows multiple roles per account as long as they are assigned to different partitions.

What is the recommended configuration for LTM v11.6 and ACS 5.2 to support variable substitution for complex RBAC assignments? For instance, UserA in AD who is a member of AD groups 'F5 Operator' and 'F5 Certs' can login and have manager access to PartitionA and Certificate Manager access to Common.