guest role; guide section ticking

plugins/tools/plugin.py

@@ -70,6 +70,19 @@ class ToolsPlugin(BasePlugin):
             ('tools.secrets', 'Create secure send links', 'tools'),
         ]
 
+    def get_guest_grantable_permissions(self) -> List[str]:
+        """Creating a secure send link is meant to work without an account.
+
+        Somebody standing at a bench needs to send a password to a vendor. The
+        recipient never had an account, and often neither does the sender - the
+        unguessable token is the authorisation, and the link is one-view.
+
+        A guest-created link records no creator. The audit trail says when and
+        from where, and never who. That is the cost, and it is why this is the
+        only write in the product offered to guests at all.
+        """
+        return ['tools.secrets']
+
     def get_settings_defaults(self) -> List[dict]:
         """The one switch this plugin owns.