#802 introduced a field in bundledeployment spec named watchNamespaces wherein users can specify the namespaces the operator needs to be configured to watch. Based on certain validations that evaluate if the Operator itself can support such configuration, Rukapk generates RBAC. This feature currently works only in registryV1 bundles.
With Helm and Plain we need to evaluate how the operator author can specify the supported install mode.