Only allow "upgrade" command on specific watchers (DEVOPS-8)