gitops role can now read queries/policies and write (but not execute) scripts