The right is tested on the context /admin but I think it should be tested on the context /cms like the download results URL specific context /extraction, we have to create one and affect it where the right Extraction_Rights_ExecuteExtraction is used.

If we have /cms to this place, it will work in a CMS only context but not with web.

Because extraction has his own workspace, it should have his own right context.