Tech Tools is reachable by the people it was built for

Every tool on that page is usable without an account, on purpose - the routes
carry no requiresAuth and say so - and Secure Send is the one write this
product offers a guest. The sidebar entry still never appeared for them: it
named no permission, so the filter that decides what a signed-out visitor may
see had nothing to go on and dropped it.

The plugin had no read permission to name, only tools.secrets, so it gains
tools.view: reaching the page at all. The tools themselves run in the browser
and touch no data, which is why this is about whether the entry appears rather
than about what anybody can read.

The item names either right. Somebody granted only Secure Send needs the entry
that leads to it, and a manager who holds neither still does not see it.

plugins/tools/plugin.py

@@ -67,6 +67,11 @@ class ToolsPlugin(BasePlugin):
         about revoking what a role does or does not hold.
         """
         return [
+            # Reaching the tools page at all. The tools themselves run in the
+            # browser and touch no data, so this is about whether the entry
+            # appears - which is exactly the question a site answers when it
+            # decides whether people without an account may use them.
+            ('tools.view', 'Use the browser tools (codes, conversions)', 'tools'),
             ('tools.secrets', 'Create secure send links', 'tools'),
         ]
 
@@ -135,6 +140,9 @@ class ToolsPlugin(BasePlugin):
                 'route': '/tools',
                 'position': 47,
                 'section': 'fleet',
+                # Either right reaches the page: somebody granted only Secure
+                # Send still needs the entry that leads to it.
+                'permission': ['tools.view', 'tools.secrets'],
             },
         ]