Follow-up from "Implement API to get single MR rule"

The following discussion from !82767 (merged) should be addressed:

• @marc_shaw started a discussion: (+6 comments)

  Thoughts: I would also add a spec for when the user can not read_approval_rule