Feature/risk assessment

This permission isn't actually needed in core, currently, so better to add it in `risk_assessments`