Application rules
Application Rules assigns a template, a specific keybox source, or an application privacy policy to an eligible application.
Where to find it: Apps / Profiles. Where is each feature?
What to do
- Choose the app and assign a template, keybox reference or privacy mode.
- Use Profiles for named policies or Apps for legacy rules.
- Inspect the result in Profiles > Effective State.
Details and limits
A valid rule already targets its app; no duplicate scope entry is needed. Empty template or keybox fields inherit the global choice. Named profiles use the most specific matching rule.
| Setting | Result |
|---|---|
inherit |
Use the global identity policy. |
isolate |
Stable app-specific telephony and supported attestation IDs; supported AIDL DRM deviceUniqueId pseudonym. |
redact |
Blank supported telephony and attestation IDs. Android permission failures remain unchanged. DRM redaction is not synthesized. |
Attestation identity changes require an active verified keybox. Packages sharing an Android UID share a policy decision; Package Manager supplies the real packages. For conflicting shared-UID telephony/attestation policies, redact takes precedence over isolate.
DRM isolation is independent from Keystore passthrough. It does not change licenses, provisioning, security level, content keys, legacy HIDL or vendor-specific interfaces. These rules do not cover sensors, clipboard, location, account IDs or every fingerprinting surface.