I would suggest business POLICY would have additional option to modify:
- ALLOW EXCEPTIONS, which would allow end-user to add an exception (well, some end-users use cracked software and as I understand it is not my policy as a business WRSA reseller to tell them not to use such a software....so I as a Web Console caretaker would not like to add exceptions for end-users, because doing so I would break, for example, my agreement woth Microsoft as a Golden partner. But if end-user does it himself, it's not my concern)