Separate category access from KB access.
The ability to create tickets and the ability to access the knowledge for a category should be managed separately. I am having to create duplicate categories to allow one that only technicians can create tickets in and another to publish KB articles to that everyone can view.