Policy can only tighten a client — never loosen it.
Every client profile (vault, daily) carries a
hard-coded ceiling that is part of the signed build. What you send from here is applied
as the intersection with that ceiling: a narrower allowlist takes effect, a wider one is ignored;
a shorter idleWipeMinutes takes effect, a longer one is clamped to the
profile value.
That is why ClickFix clipboard protection cannot be switched off from here — nor can
the download and DevTools blocks in the vault profile. This is deliberate:
a compromised hub cannot weaken the whole fleet with a single PUT.