I noticed that none of the roles, including "Admin" specifically says who can "approve" access to restricted data. I think this should be included somewhere in the "roles" description.
If this is a quick update, can we do it sooner rather than later?