This read-write field sets the actual read-access level a Security Sensitive Data rule grants, and it must stay at or below the ceiling set by the rule's rlSecSdRulePermitRead field. Admins care because this is the operative decision governing whether sensitive fields display as plaintext, decrypted, or excluded for matching sessions. For example, an admin sets this to exclude for a guest-channel rule so passwords never appear, even masked, over that channel.