In our environment, we separated to 2 levels of investigation team.
Current DLP EPO RBAC model supports separation of access for RuleSet to specific group.
ie. Lv1 can only access Ruleset A and B , while Lv 2 can access Ruleset A, B, C.
We wish to have similar separation as well for Dictionary keywords as sometimes Lv 2 need to possibly perform investigation that the general team cannot know.