The SimpleOperationDefinitionBuilder.withFlags method impls discard any existing flags instead of adding the new flags. So with something like this: return new SimpleOperationDefinitionBuilder(name, HostResolver.getResolver("host.server")) .setParameters(SERVER, BLOCKING) .setReplyType(ModelType.STRING) .setRuntimeOnly() .withFlag(OperationEntry.Flag.HOST_CONTROLLER_ONLY) .build(); The OperationEntry.Flag.RUNTIME_ONLY flag is lost from the OperationEntry. This is the cause of https://bugzilla.redhat.com/show_bug.cgi?id=1012571 – an RBAC Operator can't execute ops its should be able to execute because RUNTIME_ONLY is lost.