PCS 7 V9.0 SP3, 1 ES, 2 redundant OS server pairs, 1 MS, 5 OS clients

We recently implemented a change in authorizations for operator accounts: they were previously authorized at all process control levels (Process Controlling, Higher Process Controlling, and Highest Process Controlling), but now they are only authorized for the lowest level (Process Controlling, or Level 1).

This was only intended to restrict the ability to bypass interlocks, simulate signals, and change limit values, but it's had the unintended side-effect of rendering operators incapable of switching equipment phases between Auto and Manual modes. 

We want to restore the ability to change modes on all equipment phases, but I don't see a way to do that in SFC or CFC.  In CFC, the object properties of a block usually has a column for Operation Authorization Level, which I can set from the ES.  But the blocks for equipment phases in CFC do not have customizable authorization levels for any IOs.  I don't see a way to do this in SFC, but I'm very new to PCS 7 in general and SFC in particular.  Could anyone advise how to change the authorization level for this functionality while keeping the restriction on interlock bypasses, etc?