This is slightly more verbose and inconvenient, but it forces you to think about what the wrapper ownership and permissions will be.
This creates setcap wrappers for oping and noping to allow unprivileged users to use those as well.