Object Authority

I need some help with securing our prod iSeries systems from the experts.
Currently on our prod systems the program and data object are owned by a
system profile and the programmers have that profile as group profile.
Also many of our libs and object have public *change or *use authority. I
am wanting to get our prod systems setup such that everything is Public
*exclude, data and program objects are owned by a non-system profile (that
can't be used to sign on), and be able to restrict programmers to *use or
in some cases *change authority to data objects. I originally was going
to use group profiles with *use or *change access and just put the
programmer in the appropriate group but when objects are promoted to
production the private authorities have to be given for the group profiles
manually. I don't want folks that do the installs to have to mess with
authorities. So I am looking at authority lists since that info is saved
with the object. Would there be an issue with using an authority list and
then putting the group profiles in the list? If anyone has any advice on
gotcha's or how best to migrate, it would be greatly appreciated.

Thanks.

Mark Garton