figured it out. needed to add class permission [view security].
Now i'm able to view the security policies in Jweb.
There seems to be some discrepancy between CLI and Jweb... even with just view permissions, I can run "show security policies" ok.
Sam