Hi folks,
The fix for this needs you to require a org admin to permit a global app & configure specific labels on Orchestrator. This is quite limited in capabilities and the team is pushing a new version in the next 2 weeks, which will no longer need this.
Please stay tuned for the updates.