Major Operations allow POST (the semantics of which is "perform the operation with these parameters"). This is different from PUT which would, for example, be used to change the tags or description of the Operation. In most cases POST would be be allowed, but PUT not allowed.
However, it is conceivable that an assembly could have operations which, for a given instance/user were not allowed. We need to clarify how this is handled through the API. Would we mandate that the server only return Operations that the user could actually perform? or would the server be allowed to return Operations which the user wasn't allowed to perform with an indication that would allow the to be greyed-out in the user interface? If so we can't directly use the user mutability mechanisms, so we need to define how this works.