You could try asking a friendly PCI consultancy for advice; only one I’ve had any joy with is Metasure https://metasure.co.uk and they did want paying (after providing some free advice) but one of their guys was quite knowledgeable about changing the permission schedules…
