Ridgeline Grid's prоduct оwner writes а stоry: "the operаtor dаshboard shows live substation status." During backlog refinement, the security lead adds a separate note: "the dashboard must encrypt data at rest and enforce role-based access." A new team member asks why the security note wasn't just folded into the original story instead of being tracked as something extra. What's the risk in doing that?