found in section 2.2.2 are mentions like

Receiver implements ability to assign SLs at both the Bundle (High Water Mark) and {{Resource.meta.security.}}

Recommend this so as to make more clear that you are applying this .meta.security to all resources including Bundle. As Bundle high water mark is also in .meta.security.

Receiver implements ability to enforces SLs at both the Bundle (High Water Mark) and {Any Resource}.meta.security.

Also, I think the receiver enforces, not assigns.