Bug 32682 is adding a permission for the ability to view patron checkout history. We also need a parallel permission for patron holds history. We should make it so when IntranetReadingHistoryHolds is enabled, users with this new permission can see patron hold history but users without the permission cannot. When IntranetReadingHistoryHolds is disabled, no users should be able to see patron hold history.
Sounds good to me. I think these kinds of more granular permissions restricting access to patron information are increasingly invaluable.