As Darren states, there are many options here - so it's inherently complex. A few comments:
1. Use "Manage Security" from sample data (e.g. a CAD Doc at In Work state) to confirm permissions at every step. Add sample users to the Manage Security page, and verify that their permissions are due to mapping to Role(s).
2. Major decision to be made: Assign ACLs to Roles or Groups (or combination). Over time I've gravitated to mostly assigning to Roles and Org level, which picks up Group and/or User mapping to Roles in each Product/Library context. Have to diagram this out very well to keep organized and clear.
3. Shared teams are helpful - but only available to use if created before Products/Libraries are created (I think that this is still true in 11.x).
4. In general, all objects are assigned a Team Template by OIR on creation. Product Data (e.g. Docs, CAD Docs, WTParts) are assigned the "Default" Team team template which is empty OTB, but change objects are assigned a real team template, populated by Roles (but no users) OTB.
5. Trace from:
- Team Template assigned by OIR >> Roles, People
- Roles in Product/Library context team >> Groups, People
