The Secretary must, in any authorisation under subsection (1), specify the kind of protected information that the APS employee, or each APS employee in that class, is authorised: