Update to r53946:

Make it absolutely clear that the operator group grants access privileges
that might not be immediately obvious.