Hiya,   I have also come across this and contacted Cisco TAC - they advised a workaround using the "Security Approver" role, please be advised though that this unfortunately also allows the user to commit a change (hence the Approver part).   I found...