Just curious, why do you need filtering permissions for your use case?
Decrypting a push notification appears to be supported using 'mutable-content' with a notification service.
In fact that is the example used here: https://developer.apple.com/documentation/usernotifications/...