Security rollout with 24D opt-in functionality

Summary:

Hello

We are trying to understand implications with 24D feature to opt-in to RSSP to have a default experience. Does that mean only duty roles would get inherited, or do all the separate privileges required for some of the features also get enabled? If all privileges automatically get enabled, then how do we control the access if we opt-in but don't want to provide certain capabilities to users that are driven by specific privileges?

For Example:

PO_CHANGE_PURCHASE_ORDER_AS_PROCUREMENT_REQUESTER_PRIV

PO_CANCEL_PURCHASE_ORDER_AS_PROCUREMENT_REQUESTER_PRIV

Content (please ensure you mask any confidential information):