Operator access only. Every action here is cross-tenant.