Update notes for submitted changes

* Set security_groups:update policy to always deny