add permissions so operators can only see campaigns they're assigned to, except for superadmins