This comment is regarding authorization for POST: Do you not want to specify `OperationType.CREATE`?