Security to-do list: accepted items, kept on the server

crates/common/src/auth/permissions.rs

@@ -304,7 +304,10 @@ impl Default for DefaultPermissions {
                 | Permission::SysDlpPolicyGet
                 | Permission::SysDlpPolicyUpdate
                 | Permission::SysDlpReviewGet
-                | Permission::SysDlpReviewUpdate => {
+                | Permission::SysDlpReviewUpdate
+                // inbuxa: every security check is server-wide (security
+                // to-do list spec)
+                | Permission::SysSecurityAccept => {
                     default.superuser.push(permission);
                 }
                 // inbuxa: AL-12: tenant administrators lock and delegate

crates/common/src/manager/granted_permissions.rs

@@ -31,7 +31,8 @@ use types::id::Id;
 /// Granted to the default administrator roles: "Explain this"
 /// (ai-explain spec, EX-4: superuser by default), the audit log, account
 /// locks and legal holds (audit-hold-lock spec, AU-9, AL-12, LH-13), and
-/// the data inventory (personal-data catalog spec).
+/// the data inventory (personal-data catalog spec), and accepting security
+/// to-do items (security to-do list spec).
 const ADMIN_GRANTS: &[Permission] = &[
     Permission::SysAiExplain,
     Permission::SysAuditGet,
@@ -52,6 +53,7 @@ const ADMIN_GRANTS: &[Permission] = &[
     Permission::SysDlpPolicyUpdate,
     Permission::SysDlpReviewGet,
     Permission::SysDlpReviewUpdate,
+    Permission::SysSecurityAccept,
 ];
 
 /// Granted to the server-level Compliance Officer role once it exists: