fix(plugin-security): an organization administrator's assignment removal is judged on the stored row, and its refusal names only values the caller can read

fix(plugin-security): an organization administrator's assignment removal is judged on the stored row, and its refusal names only values the caller can read #18344