The new abusefilter-access-protected-vars right isn't included in any grants. This prevents querying abuse filter logs from bots, scripts, etc. when protected variables are involved.

Placing this in the viewrestrictedlogs grant seems best because the grant includes similar rights like abusefilter-view-private and abusefilter-log-private, but the main thing is that it should be part of some grant.