code: def recursiveUpdateRoleMappings(self, ob, wfs=None, commit_window=1000):
          
          wf_tool = api.get_tool("portal_workflow")
  
          if wfs is None:
              wfs = {}
              for id in wf_tool.objectIds():
                  wf = wf_tool.getWorkflowById(id)
                  if hasattr(aq_base(wf), 'updateRoleMappingsFor'):
                      wfs[id] = wf
  
          # Returns a count of updated objects.
          count = 0
          wf_ids = wf_tool.getChainFor(ob)
          if wf_ids:
              changed = 0
              for wf_id in wf_ids:
                  wf = wfs.get(wf_id, None)
                  if wf is not None:
                      did = wf.updateRoleMappingsFor(ob)
                      if did:
                          changed = 1
              if changed:
                  count = count + 1
                  if hasattr(aq_base(ob), 'reindexObject'):
                      # Reindex security-related indexes
                      try:
                          ob.reindexObject(idxs=['allowedRolesAndUsers'])
                      except TypeError:
                          # Catch attempts to reindex portal_catalog.
                          pass
          if hasattr(aq_base(ob), 'objectItems'):
              obs = ob.objectItems()
              if obs:
                  committed = 0
                  logged = 0
                  for k, v in obs:
                      if count - logged >= 100:
                          logger.info(
                              "Updating role mappings for {}: {}".format(
                                  repr(ob), count))
                          logged += count
  
                      changed = getattr(v, '_p_changed', 0)
                      processed = self.recursiveUpdateRoleMappings(v, wfs,
                                                                   commit_window)
                      count += processed
                      if changed is None:
                          # Re-ghostify.
                          v._p_deactivate()
  
                      if count - committed >= commit_window:
                          commit_transaction()
                          committed += count
          return count
docs: Code taken from Products.CMFPlone.WorkflowTool
  
          This version adds some commits and loggins