Ensure that attempts to publish operator shelves use object-level permissions.

r? @ngokevin