Every organisation, server and person, read-only. Operators are granted on the control-plane box, never from a form.