Based on sdk15.3, adding the 0x2902 descriptor to the rx characteristic of the ble_nus service resulted in an NRF_ERROR_FORBIDDEN error.
My code is as follows:
ble_add_descr_params_t add_SIG_descr;
static char rx_desc[] = "Server RX Data";
memset(&add_SIG_descr, 0, sizeof(add_SIG_descr));
add_SIG_descr.is_value_user = 1;
add_SIG_descr.uuid = BLE_UUID_DESCRIPTOR_CLIENT_CHAR_CONFIG;
add_SIG_descr.read_access = SEC_OPEN;
add_SIG_descr.init_len = strlen(rx_desc);
add_SIG_descr.max_len = strlen(rx_desc);
add_SIG_descr.p_value = (uint8_t *)rx_desc ;
err_code = descriptor_add(p_nus->rx_handles.value_handle, &add_SIG_descr, &p_nus->rx_handles.cccd_handle);
VERIFY_SUCCESS(err_code);