Added Risk User spec change

Added my risk with an action plan. The client decides to change what a user will be responsible for, like giving an Admin Assistant grading privileges.