Hello world,
A root user or account user should be able to block downloads or DNSoHTTPS settings among others. Like on Microsoft Edge "company administrator might change settings".
Could also be opened up to a setting server which could be this company wide enforcer.