All of the blocking changes have been made here, so I'm going to close this.
There's an idea here that might allow us to reduce cluster permissions for some of the operators, but I think that would be a separate investigation.
Thanks!