Kashmir: Add shelter permissions for OrgAdmins, use policy 7 (hierarchical realms)