fix(plugin-security): every delegable-scope branch leaves out the built-in identity positions

fix(plugin-security): every delegable-scope branch leaves out the built-in identity positions #48093