Hi Max, I would like to discuss about this issues's sub-tasks.
I do think that there are several sub-tasks that don't make sense.
I think that the CLI should be used by system administrators to manage the system: self-services, workflow and something more should have a different target.
We can group Apache Syncope users in three main typology: end-users (administrators and not), system administrators and developers.
Try to assign each features to these three groups: perhaps the CLI could include only the features given to system administrators.