The problem is that when someone who has application access goes to the Service Catalog, if they don’t click “Request” at the top right first, they end up editing the template for the catalog item. It happens allll the time, people just don’t pay attention